windmill-cli 1.777.2-gitsync.0 → 1.779.0

package/esm/main.js

@@ -16784,7 +16784,7 @@ var init_OpenAPI = __esm(() => {
     PASSWORD: undefined,
     TOKEN: getEnv3("WM_TOKEN"),
     USERNAME: undefined,
-    VERSION: "1.777.1",
+    VERSION: "1.779.0",
     WITH_CREDENTIALS: true,
     interceptors: {
       request: new Interceptors,
@@ -17098,6 +17098,7 @@ __export(exports_services_gen, {
   updateDraft: () => updateDraft,
   updateConfig: () => updateConfig,
   updateAzureTrigger: () => updateAzureTrigger,
+  updateAppRawSource: () => updateAppRawSource,
   updateAppRaw: () => updateAppRaw,
   updateAppHistory: () => updateAppHistory,
   updateApp: () => updateApp,
@@ -17263,6 +17264,7 @@ __export(exports_services_gen, {
   nativeKubernetesAutoscalingHealthcheck: () => nativeKubernetesAutoscalingHealthcheck,
   moveS3File: () => moveS3File,
   moveCapturesAndConfigs: () => moveCapturesAndConfigs,
+  mintPreviewSdkToken: () => mintPreviewSdkToken,
   migrateSecretsToVault: () => migrateSecretsToVault,
   migrateSecretsToDatabase: () => migrateSecretsToDatabase,
   migrateSecretsToAzureKv: () => migrateSecretsToAzureKv,
@@ -17302,6 +17304,7 @@ __export(exports_services_gen, {
   listTokensOfScript: () => listTokensOfScript,
   listTokensOfFlow: () => listTokensOfFlow,
   listTokens: () => listTokens,
+  listStoredFilesPaged: () => listStoredFilesPaged,
   listStoredFiles: () => listStoredFiles,
   listSqsTriggers: () => listSqsTriggers,
   listSharedUi: () => listSharedUi,
@@ -17411,6 +17414,7 @@ __export(exports_services_gen, {
   listAllTgoogleTopicSubscriptions: () => listAllTgoogleTopicSubscriptions,
   listAllDedicatedWithDeps: () => listAllDedicatedWithDeps,
   listAiSkills: () => listAiSkills,
+  listAddableInstanceUsers: () => listAddableInstanceUsers,
   leaveWorkspace: () => leaveWorkspace,
   leaveInstance: () => leaveInstance,
   isValidPostgresConfiguration: () => isValidPostgresConfiguration,
@@ -17806,6 +17810,7 @@ __export(exports_services_gen, {
   createDatatableMigration: () => createDatatableMigration,
   createCustomerPortalSession: () => createCustomerPortalSession,
   createAzureTrigger: () => createAzureTrigger,
+  createAppRawSource: () => createAppRawSource,
   createAppRaw: () => createAppRaw,
   createApp: () => createApp,
   createAmqpTrigger: () => createAmqpTrigger,
@@ -19697,6 +19702,18 @@ var backendVersion = () => {
       workspace: data3.workspace
     }
   });
+}, listAddableInstanceUsers = (data3) => {
+  return request(OpenAPI, {
+    method: "GET",
+    url: "/w/{workspace}/users/list_addable",
+    path: {
+      workspace: data3.workspace
+    },
+    query: {
+      search: data3.search,
+      per_page: data3.perPage
+    }
+  });
 }, listUsersUsage = (data3) => {
   return request(OpenAPI, {
     method: "GET",
@@ -20601,6 +20618,9 @@ var backendVersion = () => {
     url: "/apps_u/embed_token_by_custom_path/{custom_path}",
     path: {
       custom_path: data3.customPath
+    },
+    query: {
+      sdk_consent: data3.sdkConsent
     }
   });
 }, getHubScriptContentByPath = (data3) => {
@@ -21835,6 +21855,16 @@ var backendVersion = () => {
       raw_app: data3.rawApp
     }
   });
+}, mintPreviewSdkToken = (data3) => {
+  return request(OpenAPI, {
+    method: "POST",
+    url: "/w/{workspace}/apps/preview_sdk_token",
+    path: {
+      workspace: data3.workspace
+    },
+    body: data3.requestBody,
+    mediaType: "application/json"
+  });
 }, getAppEmbedTokenByPath = (data3) => {
   return request(OpenAPI, {
     method: "GET",
@@ -21842,6 +21872,9 @@ var backendVersion = () => {
     path: {
       workspace: data3.workspace,
       path: data3.path
+    },
+    query: {
+      sdk_consent: data3.sdkConsent
     }
   });
 }, getAppLiteByPath = (data3) => {
@@ -21909,6 +21942,9 @@ var backendVersion = () => {
     path: {
       workspace: data3.workspace,
       secret: data3.secret
+    },
+    query: {
+      sdk_consent: data3.sdkConsent
     }
   });
 }, getPublicResource = (data3) => {
@@ -21967,6 +22003,27 @@ var backendVersion = () => {
     body: data3.requestBody,
     mediaType: "application/json"
   });
+}, createAppRawSource = (data3) => {
+  return request(OpenAPI, {
+    method: "POST",
+    url: "/w/{workspace}/apps/create_raw_source",
+    path: {
+      workspace: data3.workspace
+    },
+    body: data3.requestBody,
+    mediaType: "application/json"
+  });
+}, updateAppRawSource = (data3) => {
+  return request(OpenAPI, {
+    method: "POST",
+    url: "/w/{workspace}/apps/update_raw_source/{path}",
+    path: {
+      workspace: data3.workspace,
+      path: data3.path
+    },
+    body: data3.requestBody,
+    mediaType: "application/json"
+  });
 }, updateAppRaw = (data3) => {
   return request(OpenAPI, {
     method: "POST",
@@ -25511,6 +25568,22 @@ var backendVersion = () => {
       max_keys: data3.maxKeys,
       marker: data3.marker,
       prefix: data3.prefix,
+      search: data3.search,
+      storage: data3.storage,
+      s3_resource_path: data3.s3ResourcePath
+    }
+  });
+}, listStoredFilesPaged = (data3) => {
+  return request(OpenAPI, {
+    method: "GET",
+    url: "/w/{workspace}/job_helpers/list_stored_files_paged",
+    path: {
+      workspace: data3.workspace
+    },
+    query: {
+      prefix: data3.prefix,
+      max_keys: data3.maxKeys,
+      page_token: data3.pageToken,
       storage: data3.storage,
       s3_resource_path: data3.s3ResourcePath
     }
@@ -26403,6 +26476,7 @@ __export(exports_gen, {
   updateDraft: () => updateDraft,
   updateConfig: () => updateConfig,
   updateAzureTrigger: () => updateAzureTrigger,
+  updateAppRawSource: () => updateAppRawSource,
   updateAppRaw: () => updateAppRaw,
   updateAppHistory: () => updateAppHistory,
   updateApp: () => updateApp,
@@ -26568,6 +26642,7 @@ __export(exports_gen, {
   nativeKubernetesAutoscalingHealthcheck: () => nativeKubernetesAutoscalingHealthcheck,
   moveS3File: () => moveS3File,
   moveCapturesAndConfigs: () => moveCapturesAndConfigs,
+  mintPreviewSdkToken: () => mintPreviewSdkToken,
   migrateSecretsToVault: () => migrateSecretsToVault,
   migrateSecretsToDatabase: () => migrateSecretsToDatabase,
   migrateSecretsToAzureKv: () => migrateSecretsToAzureKv,
@@ -26607,6 +26682,7 @@ __export(exports_gen, {
   listTokensOfScript: () => listTokensOfScript,
   listTokensOfFlow: () => listTokensOfFlow,
   listTokens: () => listTokens,
+  listStoredFilesPaged: () => listStoredFilesPaged,
   listStoredFiles: () => listStoredFiles,
   listSqsTriggers: () => listSqsTriggers,
   listSharedUi: () => listSharedUi,
@@ -26716,6 +26792,7 @@ __export(exports_gen, {
   listAllTgoogleTopicSubscriptions: () => listAllTgoogleTopicSubscriptions,
   listAllDedicatedWithDeps: () => listAllDedicatedWithDeps,
   listAiSkills: () => listAiSkills,
+  listAddableInstanceUsers: () => listAddableInstanceUsers,
   leaveWorkspace: () => leaveWorkspace,
   leaveInstance: () => leaveInstance,
   isValidPostgresConfiguration: () => isValidPostgresConfiguration,
@@ -27111,6 +27188,7 @@ __export(exports_gen, {
   createDatatableMigration: () => createDatatableMigration,
   createCustomerPortalSession: () => createCustomerPortalSession,
   createAzureTrigger: () => createAzureTrigger,
+  createAppRawSource: () => createAppRawSource,
   createAppRaw: () => createAppRaw,
   createApp: () => createApp,
   createAmqpTrigger: () => createAmqpTrigger,
@@ -27187,8 +27265,13 @@ var init_gen = __esm(() => {
 // src/core/client.ts
 var exports_client = {};
 __export(exports_client, {
-  setClient: () => setClient
+  setClient: () => setClient,
+  markRequestsAsSyncOrigin: () => markRequestsAsSyncOrigin
 });
+function markRequestsAsSyncOrigin() {
+  const existing = typeof OpenAPI.HEADERS === "object" ? OpenAPI.HEADERS : {};
+  OpenAPI.HEADERS = { ...existing, "X-Windmill-Deploy-Origin": "sync" };
+}
 function setClient(token, baseUrl2) {
   if (baseUrl2 === undefined) {
     baseUrl2 = process.env["BASE_INTERNAL_URL"] ?? process.env["BASE_URL"] ?? "http://localhost:8000";
@@ -27289,7 +27372,7 @@ var init_auth = __esm(async () => {
 });
 
 // src/core/constants.ts
-var WM_FORK_PREFIX = "wm-fork", VERSION = "1.777.2-gitsync.0";
+var WM_FORK_PREFIX = "wm-fork", VERSION = "1.779.0";
 
 // src/utils/git.ts
 var exports_git = {};
@@ -29977,6 +30060,9 @@ Deploying ${colors.bold(String(selectedDiffs.length))} item(s)...`);
   });
   const workspaceFrom = direction === "to-parent" ? forkWorkspaceId : parentWorkspaceId;
   const workspaceTo = direction === "to-parent" ? parentWorkspaceId : forkWorkspaceId;
+  if (direction === "to-fork") {
+    markRequestsAsSyncOrigin();
+  }
   let successCount = 0;
   let failCount = 0;
   const deployedMigrations = [];
@@ -50108,7 +50194,7 @@ var require_zipEntries = __commonJS((exports, module) => {
       if (this.centralDirRecords !== this.files.length) {
         if (this.centralDirRecords !== 0 && this.files.length === 0) {
           throw new Error("Corrupted zip or bug: expected " + this.centralDirRecords + " records in central dir, got " + this.files.length);
-        } else {}
+        }
       }
     },
     readEndOfCentral: function() {
@@ -58516,7 +58602,7 @@ var require_loader = __commonJS((exports, module) => {
     var error2 = generateError(state, message);
     if (state.onWarning) {
       state.onWarning.call(null, error2);
-    } else {}
+    }
   }
   var directiveHandlers = {
     YAML: function handleYamlDirective(state, name, args) {
@@ -59054,7 +59140,7 @@ var require_loader = __commonJS((exports, module) => {
       } else if (detectedIndent) {
         sc.value += common3.repeat(`
 `, emptyLines + 1);
-      } else {}
+      }
       detectedIndent = true;
       emptyLines = 0;
       captureStart = state.position;
@@ -61503,7 +61589,7 @@ var init_openflow = __esm(() => {
   openflow_default = {
     openapi: "3.0.3",
     info: {
-      version: "1.777.1",
+      version: "1.779.0",
       title: "OpenFlow Spec",
       contact: {
         name: "Ruben Fiszel",
@@ -71502,6 +71588,7 @@ async function checkServerLockJobs(workspaceId, sinceIso, changedPaths) {
 async function push4(opts) {
   if (opts.jsonOutput)
     setSilent(true);
+  markRequestsAsSyncOrigin();
   const originalCliOpts = { ...opts };
   opts = await mergeConfigWithConfigFile(opts);
   if (originalCliOpts.includeSecrets) {
@@ -72563,6 +72650,7 @@ var import_yaml12, branchDeprecationWarned = false, yamlOptions, _caseInsensitiv
   return p == "." + SEP9 || p == "" || p == "u" || p == "f" || p == "g" || p == "ui" || p == "users" || p == "groups" || p == "dependencies" || p == "migrations";
 }, SYNC_PUSH_DESTRUCTIVE_WARNING = "`wmill sync push` is destructive: applying it deploys these changes to the remote workspace and overwrites or deletes remote items that differ from or are absent locally — this is not automatically reversible. If you are an AI agent, do NOT run `wmill sync push` (without --dry-run) until the user has explicitly confirmed this deploy, unless your custom instructions explicitly allow bypassing that confirmation.", command8, sync_default;
 var init_sync = __esm(async () => {
+  init_client();
   init_colors2();
   init_mod3();
   init_log();
@@ -76523,9 +76611,47 @@ var init_lint2 = __esm(async () => {
   lint_default2 = command11;
 });
 
+// src/commands/app/bundle_command.ts
+import * as fs15 from "node:fs";
+import * as path19 from "node:path";
+import process19 from "node:process";
+function entryPointFor(appDir) {
+  const frameworks = detectFrameworks(appDir);
+  const candidates = frameworks.svelte || frameworks.vue ? ["index.ts", "index.tsx", "index.js"] : ["index.tsx", "index.ts", "index.js"];
+  const entry = candidates.find((c) => fs15.existsSync(path19.join(appDir, c)));
+  if (!entry) {
+    throw new Error(`No entry point in ${appDir}: expected one of ${candidates.join(", ")}`);
+  }
+  return path19.join(appDir, entry);
+}
+async function bundleApp(opts, appFolder) {
+  const appDir = path19.resolve(appFolder ?? process19.cwd());
+  const { js, css } = await createBundle({
+    entryPoint: entryPointFor(appDir),
+    production: true,
+    minify: opts.minify ?? true,
+    sharedUiDir: path19.join(process19.cwd(), "ui"),
+    outDir: `.wmill-bundle-${process19.pid}`
+  });
+  const outDir = path19.resolve(opts.out ?? path19.join(appDir, "dist"));
+  fs15.mkdirSync(outDir, { recursive: true });
+  fs15.writeFileSync(path19.join(outDir, "bundle.js"), js);
+  fs15.writeFileSync(path19.join(outDir, "bundle.css"), css);
+  info(colors.green(`Wrote bundle.js and bundle.css to ${outDir}`));
+}
+var command12, bundle_command_default;
+var init_bundle_command = __esm(async () => {
+  init_mod3();
+  init_log();
+  init_colors2();
+  await init_bundle();
+  command12 = new Command().description("Bundle a raw app folder to js/css without deploying it").arguments("[app_folder:string]").option("--out <dir:string>", "Directory to write bundle.js and bundle.css into (default: <app_folder>/dist)").option("--no-minify", "Skip minification").action(bundleApp);
+  bundle_command_default = command12;
+});
+
 // src/commands/app/new.ts
 import { stat as stat9, writeFile as writeFile10, mkdir as mkdir7, rm as rm4 } from "node:fs/promises";
-import path19 from "node:path";
+import path20 from "node:path";
 import { execSync as execSync5, exec, execFile as execFile6 } from "node:child_process";
 function validateAppPath(appPath) {
   if (!appPath.startsWith("u/") && !appPath.startsWith("f/")) {
@@ -76781,7 +76907,7 @@ CREATE SCHEMA IF NOT EXISTS ${schemaName};
   }
   await loadNonDottedPathsSetting();
   const folderName2 = buildFolderPath(appPath, "raw_app");
-  const appDir = path19.join(process.cwd(), folderName2);
+  const appDir = path20.join(process.cwd(), folderName2);
   let dirExists = false;
   try {
     await stat9(appDir);
@@ -76806,17 +76932,17 @@ CREATE SCHEMA IF NOT EXISTS ${schemaName};
     await rm4(appDir, { recursive: true, force: true });
   }
   await mkdir7(appDir, { recursive: true });
-  await mkdir7(path19.join(appDir, "backend"), { recursive: true });
-  await mkdir7(path19.join(appDir, "sql_to_apply"), { recursive: true });
+  await mkdir7(path20.join(appDir, "backend"), { recursive: true });
+  await mkdir7(path20.join(appDir, "sql_to_apply"), { recursive: true });
   const rawAppConfig = {
     summary
   };
   if (dataConfig.datatable) {
     rawAppConfig.data = dataConfig;
   }
-  await writeFile10(path19.join(appDir, "raw_app.yaml"), import_yaml23.stringify(rawAppConfig, yamlOptions), "utf-8");
+  await writeFile10(path20.join(appDir, "raw_app.yaml"), import_yaml23.stringify(rawAppConfig, yamlOptions), "utf-8");
   for (const [filePath, content] of Object.entries(template.files)) {
-    const fullPath = path19.join(appDir, filePath.slice(1));
+    const fullPath = path20.join(appDir, filePath.slice(1));
     await writeFile10(fullPath, content.trim() + `
 `, "utf-8");
   }
@@ -76826,21 +76952,21 @@ CREATE SCHEMA IF NOT EXISTS ${schemaName};
     schema: dataConfig.schema
   } : undefined;
   const agentsContent = generateAgentsDocumentation(dataForDocs);
-  await writeFile10(path19.join(appDir, "AGENTS.md"), agentsContent, "utf-8");
-  await writeFile10(path19.join(appDir, "CLAUDE.md"), `Instructions are in @AGENTS.md
+  await writeFile10(path20.join(appDir, "AGENTS.md"), agentsContent, "utf-8");
+  await writeFile10(path20.join(appDir, "CLAUDE.md"), `Instructions are in @AGENTS.md
 `, "utf-8");
   const datatablesContent = generateDatatablesDocumentation(dataForDocs);
-  await writeFile10(path19.join(appDir, "DATATABLES.md"), datatablesContent, "utf-8");
+  await writeFile10(path20.join(appDir, "DATATABLES.md"), datatablesContent, "utf-8");
   const exampleRunnable = {
     type: "inline",
     path: undefined
   };
-  await writeFile10(path19.join(appDir, "backend", "a.yaml"), import_yaml23.stringify(exampleRunnable, yamlOptions), "utf-8");
-  await writeFile10(path19.join(appDir, "backend", "a.ts"), `export async function main(x: number): Promise<string> {
+  await writeFile10(path20.join(appDir, "backend", "a.yaml"), import_yaml23.stringify(exampleRunnable, yamlOptions), "utf-8");
+  await writeFile10(path20.join(appDir, "backend", "a.ts"), `export async function main(x: number): Promise<string> {
   return \`Hello from backend! x = \${x}\`;
 }
 `, "utf-8");
-  await writeFile10(path19.join(appDir, "sql_to_apply", "README.md"), `# SQL Migrations Folder
+  await writeFile10(path20.join(appDir, "sql_to_apply", "README.md"), `# SQL Migrations Folder
 
 This folder is for SQL migration files that will be applied to datatables during development.
 
@@ -76868,7 +76994,7 @@ This folder is for SQL migration files that will be applied to datatables during
 - Use idempotent SQL (\`CREATE TABLE IF NOT EXISTS\`, etc.)
 `);
   if (createSchemaSQL && schemaName) {
-    await writeFile10(path19.join(appDir, "sql_to_apply", `000_create_schema_${schemaName}.sql`), createSchemaSQL, "utf-8");
+    await writeFile10(path20.join(appDir, "sql_to_apply", `000_create_schema_${schemaName}.sql`), createSchemaSQL, "utf-8");
   }
   info("");
   info(colors.bold.green(`App created successfully at ${folderName2}/`));
@@ -76924,9 +77050,9 @@ This folder is for SQL migration files that will be applied to datatables during
     });
     if (openInDesktop) {
       try {
-        const absAppDir = path19.resolve(appDir);
-        const claudeDir = path19.join(absAppDir, ".claude");
-        const launchPath = path19.join(claudeDir, "launch.json");
+        const absAppDir = path20.resolve(appDir);
+        const claudeDir = path20.join(absAppDir, ".claude");
+        const launchPath = path20.join(claudeDir, "launch.json");
         if (!await stat9(launchPath).catch(() => null)) {
           const launchJson = JSON.stringify({
             version: "0.0.1",
@@ -76941,7 +77067,7 @@ This folder is for SQL migration files that will be applied to datatables during
 `;
           await mkdir7(claudeDir, { recursive: true });
           await writeFile10(launchPath, launchJson, "utf-8");
-          info(colors.gray(`Seeded ${path19.relative(process.cwd(), launchPath)}`));
+          info(colors.gray(`Seeded ${path20.relative(process.cwd(), launchPath)}`));
         }
         const sessionId = crypto.randomUUID();
         const frames = ["⠋", "⠙", "⠹", "⠸", "⠼", "⠴", "⠦", "⠧", "⠇", "⠏"];
@@ -76950,8 +77076,8 @@ This folder is for SQL migration files that will be applied to datatables during
           process.stdout.write(`\r${colors.gray(`${frames[i++ % frames.length]} Creating Claude session...`)}`);
         }, 80);
         try {
-          await new Promise((resolve10, reject) => {
-            exec(`claude --session-id "${sessionId}" -p "Say: Your app is ready, click on preview to test it!"`, { cwd: absAppDir }, (error2) => error2 ? reject(error2) : resolve10());
+          await new Promise((resolve11, reject) => {
+            exec(`claude --session-id "${sessionId}" -p "Say: Your app is ready, click on preview to test it!"`, { cwd: absAppDir }, (error2) => error2 ? reject(error2) : resolve11());
           });
         } finally {
           clearInterval(spinner);
@@ -77056,7 +77182,7 @@ createApp(App).mount('#root')`, indexCss = `body {
 .myclass {
     border: 1px solid gray;
     padding: 2px;
-}`, templates, command12, new_default;
+}`, templates, command13, new_default;
 var init_new = __esm(async () => {
   init_mod3();
   init_colors2();
@@ -77141,8 +77267,8 @@ var init_new = __esm(async () => {
       }
     }
   };
-  command12 = new Command().description("create a new raw app from a template").option("--summary <summary:string>", "App summary (short description). Skips the prompt when provided. Triggers non-interactive mode.").option("--path <path:string>", "App path (e.g., f/folder/my_app or u/username/my_app). Skips the prompt when provided. Triggers non-interactive mode.").option("--framework <framework:string>", "Framework template: react19 | react18 | svelte5 | vue. Skips the prompt when provided. Triggers non-interactive mode.").option("--datatable <datatable:string>", "Datatable to wire up. Without this flag in non-interactive mode, no datatable is configured.").option("--schema <schema:string>", "Schema to use with --datatable. Created (CREATE SCHEMA IF NOT EXISTS) if it doesn't already exist.").option("--overwrite", "Overwrite the target directory if it already exists, without prompting.").option("--no-open-in-desktop", "Do not prompt to open the new app in Claude Desktop.").action(newApp);
-  new_default = command12;
+  command13 = new Command().description("create a new raw app from a template").option("--summary <summary:string>", "App summary (short description). Skips the prompt when provided. Triggers non-interactive mode.").option("--path <path:string>", "App path (e.g., f/folder/my_app or u/username/my_app). Skips the prompt when provided. Triggers non-interactive mode.").option("--framework <framework:string>", "Framework template: react19 | react18 | svelte5 | vue. Skips the prompt when provided. Triggers non-interactive mode.").option("--datatable <datatable:string>", "Datatable to wire up. Without this flag in non-interactive mode, no datatable is configured.").option("--schema <schema:string>", "Schema to use with --datatable. Created (CREATE SCHEMA IF NOT EXISTS) if it doesn't already exist.").option("--overwrite", "Overwrite the target directory if it already exists, without prompting.").option("--no-open-in-desktop", "Do not prompt to open the new app in Claude Desktop.").action(newApp);
+  new_default = command13;
 });
 
 // src/commands/app/app.ts
@@ -77243,8 +77369,8 @@ async function pushApp(workspace, remotePath, localPath, message, permissionedAs
   if (!localPath.endsWith(SEP14)) {
     localPath += SEP14;
   }
-  const path20 = localPath + "app.yaml";
-  const localApp = await yamlParseFile(path20);
+  const path21 = localPath + "app.yaml";
+  const localApp = await yamlParseFile(path21);
   replaceInlineScripts2(localApp.value, localPath, true);
   await generatingPolicy2(localApp, remotePath, localApp?.["public"] ?? localApp?.["policy"]?.["execution_mode"] == "anonymous");
   const preserveFields = {};
@@ -77290,13 +77416,13 @@ async function pushApp(workspace, remotePath, localPath, message, permissionedAs
   }
   await applyExtraPermsDiff(workspace, "app", remotePath, localPerms, app?.extra_perms);
 }
-async function generatingPolicy2(app, path20, publicApp) {
-  info(colors.gray(`Generating fresh policy for app ${path20}...`));
+async function generatingPolicy2(app, path21, publicApp) {
+  info(colors.gray(`Generating fresh policy for app ${path21}...`));
   try {
     app.policy = await updatePolicy(app.value, undefined);
     app.policy.execution_mode = publicApp ? "anonymous" : "publisher";
   } catch (e) {
-    error(colors.red(`Error generating policy for app ${path20}: ${e}`));
+    error(colors.red(`Error generating policy for app ${path21}: ${e}`));
     throw e;
   }
 }
@@ -77325,12 +77451,12 @@ async function list6(opts) {
     new Table2().header(["path", "summary"]).padding(2).border(true).body(total.map((x) => [x.path, x.summary])).render();
   }
 }
-async function get4(opts, path20) {
+async function get4(opts, path21) {
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   const a = await getAppByPath({
     workspace: workspace.workspaceId,
-    path: path20
+    path: path21
   });
   if (opts.json) {
     console.log(JSON.stringify(a));
@@ -77410,7 +77536,7 @@ async function push5(opts, filePath, remotePath) {
     info(colors.bold.underline.green("App pushed"));
   }
 }
-var alreadySynced2, APP_FOLDER_SUFFIXES, command13, app_default;
+var alreadySynced2, APP_FOLDER_SUFFIXES, command14, app_default;
 var init_app = __esm(async () => {
   init_mod3();
   init_mod6();
@@ -77429,12 +77555,13 @@ var init_app = __esm(async () => {
     init_utils(),
     init_dev(),
     init_lint2(),
+    init_bundle_command(),
     init_new(),
     init_generate_agents()
   ]);
   alreadySynced2 = [];
   APP_FOLDER_SUFFIXES = ["__raw_app", ".raw_app", "__app", ".app"];
-  command13 = new Command().description("app related commands").option("--json", "Output as JSON (for piping to jq)").action(list6).command("list", "list all apps").option("--json", "Output as JSON (for piping to jq)").action(list6).command("get", "get an app's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get4).command("push", "push a local app. With no args, infers the app from the current directory and the remote path from its location relative to wmill.yaml.").arguments("[file_path:string] [remote_path:string]").action(push5).command("dev", dev_default).command("lint", lint_default2).command("new", new_default).command("generate-agents", generate_agents_default).command("generate-locks", 'DEPRECATED: re-generate app lockfiles. Use "wmill generate-metadata" instead.').arguments("[app_folder:string]").option("--yes", "Skip confirmation prompt").option("--dry-run", "Perform a dry run without making changes").option("--default-ts <runtime:string>", "Default TypeScript runtime (bun or deno)").action(async (opts, appFolder) => {
+  command14 = new Command().description("app related commands").option("--json", "Output as JSON (for piping to jq)").action(list6).command("list", "list all apps").option("--json", "Output as JSON (for piping to jq)").action(list6).command("get", "get an app's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get4).command("push", "push a local app. With no args, infers the app from the current directory and the remote path from its location relative to wmill.yaml.").arguments("[file_path:string] [remote_path:string]").action(push5).command("dev", dev_default).command("lint", lint_default2).command("bundle", bundle_command_default).command("new", new_default).command("generate-agents", generate_agents_default).command("generate-locks", 'DEPRECATED: re-generate app lockfiles. Use "wmill generate-metadata" instead.').arguments("[app_folder:string]").option("--yes", "Skip confirmation prompt").option("--dry-run", "Perform a dry run without making changes").option("--default-ts <runtime:string>", "Default TypeScript runtime (bun or deno)").action(async (opts, appFolder) => {
     warn(colors.yellow('This command is deprecated. Use "wmill generate-metadata" instead.'));
     const { generateLocksCommand: generateLocksCommand2 } = await init_app_metadata().then(() => exports_app_metadata);
     await generateLocksCommand2(opts, appFolder);
@@ -77465,7 +77592,7 @@ var init_app = __esm(async () => {
     });
     info(colors.green(`Updated permissioned_as for app ${appPath} to ${email}`));
   });
-  app_default = command13;
+  app_default = command14;
 });
 
 // src/commands/folder/folder.ts
@@ -77629,7 +77756,7 @@ async function addMissing(opts) {
   info(`
 Created ${missing.length} folder.meta.yaml file(s). You can now run 'wmill sync push' to push them.`);
 }
-var import_yaml25, command14, folder_default;
+var import_yaml25, command15, folder_default;
 var init_folder = __esm(async () => {
   init_colors2();
   init_mod3();
@@ -77643,7 +77770,7 @@ var init_folder = __esm(async () => {
     init_types()
   ]);
   import_yaml25 = __toESM(require_dist(), 1);
-  command14 = new Command().description("folder related commands").option("--json", "Output as JSON (for piping to jq)").action(list7).command("list", "list all folders").option("--json", "Output as JSON (for piping to jq)").action(list7).command("get", "get a folder's details").arguments("<name:string>").option("--json", "Output as JSON (for piping to jq)").action(get5).command("new", "create a new folder locally").arguments("<name:string>").option("--summary <summary:string>", "folder summary").action(newFolder).command("push", "push a local folder to the remote by name. This overrides any remote versions.").arguments("<name:string>").action(push6).command("add-missing", "create default folder.meta.yaml for all subdirectories of f/ that are missing one").option("-y, --yes", "skip confirmation prompt").action(addMissing).command("show-rules", "Show default_permissioned_as rules for a folder. Use --test-path to see which rule matches a given item path.").arguments("<name:string>").option("--test-path <path:string>", "Test which rule matches this item path (e.g. f/prod/jobs/my_script)").option("--json", "Output as JSON").action(async (opts, folderName2) => {
+  command15 = new Command().description("folder related commands").option("--json", "Output as JSON (for piping to jq)").action(list7).command("list", "list all folders").option("--json", "Output as JSON (for piping to jq)").action(list7).command("get", "get a folder's details").arguments("<name:string>").option("--json", "Output as JSON (for piping to jq)").action(get5).command("new", "create a new folder locally").arguments("<name:string>").option("--summary <summary:string>", "folder summary").action(newFolder).command("push", "push a local folder to the remote by name. This overrides any remote versions.").arguments("<name:string>").action(push6).command("add-missing", "create default folder.meta.yaml for all subdirectories of f/ that are missing one").option("-y, --yes", "skip confirmation prompt").action(addMissing).command("show-rules", "Show default_permissioned_as rules for a folder. Use --test-path to see which rule matches a given item path.").arguments("<name:string>").option("--test-path <path:string>", "Test which rule matches this item path (e.g. f/prod/jobs/my_script)").option("--json", "Output as JSON").action(async (opts, folderName2) => {
     const workspace = await resolveWorkspace(opts);
     await requireLogin(opts);
     const folder = await getFolder({
@@ -77691,7 +77818,7 @@ var init_folder = __esm(async () => {
       info(colors.yellow(`No rule matches path '${testPath}' (relative: '${relative8}')`));
     }
   });
-  folder_default = command14;
+  folder_default = command15;
 });
 
 // src/commands/variable/variable.ts
@@ -77717,11 +77844,11 @@ async function list8(opts) {
     ])).render();
   }
 }
-async function newVariable(opts, path20) {
-  if (!validatePath(path20)) {
+async function newVariable(opts, path21) {
+  if (!validatePath(path21)) {
     return;
   }
-  const filePath = path20 + ".variable.yaml";
+  const filePath = path21 + ".variable.yaml";
   try {
     await stat12(filePath);
     throw new Error("File already exists: " + filePath);
@@ -77741,14 +77868,14 @@ async function newVariable(opts, path20) {
   });
   info(colors.green(`Created ${filePath}`));
 }
-async function get6(opts, path20) {
+async function get6(opts, path21) {
   if (opts.json)
     setSilent(true);
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   const v = await getVariable({
     workspace: workspace.workspaceId,
-    path: path20
+    path: path21
   });
   if (opts.json) {
     console.log(JSON.stringify(v));
@@ -77899,7 +78026,7 @@ async function add2(opts, value, remotePath) {
   }
   info(colors.bold.underline.green(`Variable ${remotePath} pushed`));
 }
-var import_yaml26, command15, variable_default;
+var import_yaml26, command16, variable_default;
 var init_variable = __esm(async () => {
   init_mod3();
   init_mod6();
@@ -77913,8 +78040,8 @@ var init_variable = __esm(async () => {
     init_confirm()
   ]);
   import_yaml26 = __toESM(require_dist(), 1);
-  command15 = new Command().description("variable related commands").option("--json", "Output as JSON (for piping to jq)").action(list8).command("list", "list all variables").option("--json", "Output as JSON (for piping to jq)").action(list8).command("get", "get a variable's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get6).command("new", "create a new variable locally").arguments("<path:string>").action(newVariable).command("push", "Push a local variable spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").option("--plain-secrets", "Push secrets as plain text").action(push7).command("add", "Create a new variable on the remote. This will update the variable if it already exists.").arguments("<value:string> <remote_path:string>").option("--yes", "Skip confirmation prompt when updating an existing variable").option("--secret", "Mark the variable as secret (default when creating a new variable)").option("--no-secret", "Mark the variable as non-secret (when updating, the existing setting is preserved if neither --secret nor --no-secret is passed)").option("--description <description:string>", "Set the variable description (when updating, the existing description is preserved if not passed)").option("--plain-secrets", "Push secrets as plain text").option("--public", "Legacy option, use --no-secret instead").action(add2);
-  variable_default = command15;
+  command16 = new Command().description("variable related commands").option("--json", "Output as JSON (for piping to jq)").action(list8).command("list", "list all variables").option("--json", "Output as JSON (for piping to jq)").action(list8).command("get", "get a variable's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get6).command("new", "create a new variable locally").arguments("<path:string>").action(newVariable).command("push", "Push a local variable spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").option("--plain-secrets", "Push secrets as plain text").action(push7).command("add", "Create a new variable on the remote. This will update the variable if it already exists.").arguments("<value:string> <remote_path:string>").option("--yes", "Skip confirmation prompt when updating an existing variable").option("--secret", "Mark the variable as secret (default when creating a new variable)").option("--no-secret", "Mark the variable as non-secret (when updating, the existing setting is preserved if neither --secret nor --no-secret is passed)").option("--description <description:string>", "Set the variable description (when updating, the existing description is preserved if not passed)").option("--plain-secrets", "Push secrets as plain text").option("--public", "Legacy option, use --no-secret instead").action(add2);
+  variable_default = command16;
 });
 
 // src/commands/schedule/schedule.ts
@@ -77935,11 +78062,11 @@ async function list9(opts) {
     new Table2().header(["Path", "Schedule"]).padding(2).border(true).body(schedules.map((x) => [x.path, x.schedule])).render();
   }
 }
-async function newSchedule(opts, path20) {
-  if (!validatePath(path20)) {
+async function newSchedule(opts, path21) {
+  if (!validatePath(path21)) {
     return;
   }
-  const filePath = path20 + ".schedule.yaml";
+  const filePath = path21 + ".schedule.yaml";
   try {
     await stat13(filePath);
     throw new Error("File already exists: " + filePath);
@@ -77963,14 +78090,14 @@ async function newSchedule(opts, path20) {
   });
   info(colors.green(`Created ${filePath}`));
 }
-async function get7(opts, path20) {
+async function get7(opts, path21) {
   if (opts.json)
     setSilent(true);
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   const s = await getSchedule({
     workspace: workspace.workspaceId,
-    path: path20
+    path: path21
   });
   if (opts.json) {
     console.log(JSON.stringify(s));
@@ -77983,14 +78110,14 @@ async function get7(opts, path20) {
     console.log(colors.bold("Enabled:") + " " + (s.enabled ? "true" : "false"));
   }
 }
-async function pushSchedule(workspace, path20, schedule, localSchedule, permissionedAsContext) {
-  path20 = removeType(path20, "schedule").replaceAll(SEP17, "/");
-  debug(`Processing local schedule ${path20}`);
+async function pushSchedule(workspace, path21, schedule, localSchedule, permissionedAsContext) {
+  path21 = removeType(path21, "schedule").replaceAll(SEP17, "/");
+  debug(`Processing local schedule ${path21}`);
   try {
-    schedule = await getSchedule({ workspace, path: path20 });
-    debug(`Schedule ${path20} exists on remote`);
+    schedule = await getSchedule({ workspace, path: path21 });
+    debug(`Schedule ${path21} exists on remote`);
   } catch {
-    debug(`Schedule ${path20} does not exist on remote`);
+    debug(`Schedule ${path21} does not exist on remote`);
   }
   delete localSchedule.has_permissioned_as;
   const preserveFields = {};
@@ -77999,31 +78126,31 @@ async function pushSchedule(workspace, path20, schedule, localSchedule, permissi
       preserveFields.preserve_permissioned_as = true;
       if (schedule.permissioned_as) {
         preserveFields.permissioned_as = schedule.permissioned_as;
-        info(`Preserving ${schedule.permissioned_as} as permissioned_as for schedule ${path20}`);
+        info(`Preserving ${schedule.permissioned_as} as permissioned_as for schedule ${path21}`);
       }
     }
   }
   if (schedule) {
     if (isSuperset(localSchedule, schedule)) {
-      debug(`Schedule ${path20} is up to date`);
+      debug(`Schedule ${path21} is up to date`);
       return;
     }
-    debug(`Updating schedule ${path20}`);
+    debug(`Updating schedule ${path21}`);
     try {
-      info(colors.bold.yellow(`Updating schedule ${path20}`));
+      info(colors.bold.yellow(`Updating schedule ${path21}`));
       await updateSchedule({
         workspace,
-        path: path20,
+        path: path21,
         requestBody: {
           ...localSchedule,
           ...preserveFields
         }
       });
       if (localSchedule.enabled !== undefined && localSchedule.enabled !== schedule.enabled) {
-        info(colors.bold.yellow(`Schedule ${path20} is ${localSchedule.enabled ? "enabled" : "disabled"} locally but not on remote, updating remote`));
+        info(colors.bold.yellow(`Schedule ${path21} is ${localSchedule.enabled ? "enabled" : "disabled"} locally but not on remote, updating remote`));
         await setScheduleEnabled({
           workspace,
-          path: path20,
+          path: path21,
           requestBody: {
             enabled: localSchedule.enabled
           }
@@ -78034,12 +78161,12 @@ async function pushSchedule(workspace, path20, schedule, localSchedule, permissi
       throw e;
     }
   } else {
-    console.log(colors.bold.yellow("Creating new schedule " + path20));
+    console.log(colors.bold.yellow("Creating new schedule " + path21));
     try {
       await createSchedule({
         workspace,
         requestBody: {
-          path: path20,
+          path: path21,
           ...localSchedule,
           ...preserveFields
         }
@@ -78050,26 +78177,26 @@ async function pushSchedule(workspace, path20, schedule, localSchedule, permissi
     }
   }
 }
-async function enable(opts, path20) {
+async function enable(opts, path21) {
   opts = await mergeConfigWithConfigFile(opts);
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   try {
     await setScheduleEnabled({
       workspace: workspace.workspaceId,
-      path: path20,
+      path: path21,
       requestBody: { enabled: true, force: opts.force }
     });
   } catch (e) {
     const conflict = parseForkConflict(e);
     if (conflict) {
-      error(`Cannot enable schedule '${path20}': the parent workspace '${conflict.parentWorkspaceId}' has the same path configured. ` + `Both crons would fire on every tick and the script would run twice per scheduled time.
+      error(`Cannot enable schedule '${path21}': the parent workspace '${conflict.parentWorkspaceId}' has the same path configured. ` + `Both crons would fire on every tick and the script would run twice per scheduled time.
 ` + `Re-run with --force to enable anyway.`);
       process.exit(1);
     }
     throw e;
   }
-  info(colors.green(`Schedule ${path20} enabled.`));
+  info(colors.green(`Schedule ${path21} enabled.`));
 }
 function parseForkConflict(e) {
   const body = e?.body;
@@ -78079,16 +78206,16 @@ function parseForkConflict(e) {
     return;
   return { kind: m[1], parentWorkspaceId: m[2].trim() };
 }
-async function disable(opts, path20) {
+async function disable(opts, path21) {
   opts = await mergeConfigWithConfigFile(opts);
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   await setScheduleEnabled({
     workspace: workspace.workspaceId,
-    path: path20,
+    path: path21,
     requestBody: { enabled: false }
   });
-  info(colors.yellow(`Schedule ${path20} disabled.`));
+  info(colors.yellow(`Schedule ${path21} disabled.`));
 }
 async function push8(opts, filePath, remotePath) {
   const workspace = await resolveWorkspace(opts);
@@ -78104,7 +78231,7 @@ async function push8(opts, filePath, remotePath) {
   await pushSchedule(workspace.workspaceId, remotePath, undefined, parseFromFile(filePath));
   console.log(colors.bold.underline.green("Schedule pushed"));
 }
-var import_yaml27, command16, schedule_default2;
+var import_yaml27, command17, schedule_default2;
 var init_schedule2 = __esm(async () => {
   init_mod3();
   init_mod6();
@@ -78119,7 +78246,7 @@ var init_schedule2 = __esm(async () => {
     init_types()
   ]);
   import_yaml27 = __toESM(require_dist(), 1);
-  command16 = new Command().description("schedule related commands").option("--json", "Output as JSON (for piping to jq)").action(list9).command("list", "list all schedules").option("--json", "Output as JSON (for piping to jq)").action(list9).command("get", "get a schedule's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get7).command("new", "create a new schedule locally").arguments("<path:string>").action(newSchedule).command("push", "push a local schedule spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").action(push8).command("enable", "Enable a schedule").option("--force", "Bypass the fork-conflict warning when the parent workspace has the same schedule (acknowledges that both crons will fire)").arguments("<path:string>").action(enable).command("disable", "Disable a schedule").arguments("<path:string>").action(disable).command("set-permissioned-as", "Set the email (run-as user) for a schedule (requires admin or wm_deployers group)").arguments("<path:string> <email:string>").action(async (opts, schedulePath, email) => {
+  command17 = new Command().description("schedule related commands").option("--json", "Output as JSON (for piping to jq)").action(list9).command("list", "list all schedules").option("--json", "Output as JSON (for piping to jq)").action(list9).command("get", "get a schedule's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get7).command("new", "create a new schedule locally").arguments("<path:string>").action(newSchedule).command("push", "push a local schedule spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").action(push8).command("enable", "Enable a schedule").option("--force", "Bypass the fork-conflict warning when the parent workspace has the same schedule (acknowledges that both crons will fire)").arguments("<path:string>").action(enable).command("disable", "Disable a schedule").arguments("<path:string>").action(disable).command("set-permissioned-as", "Set the email (run-as user) for a schedule (requires admin or wm_deployers group)").arguments("<path:string> <email:string>").action(async (opts, schedulePath, email) => {
     const workspace = await resolveWorkspace(opts);
     await requireLogin(opts);
     const cache3 = new Map;
@@ -78141,7 +78268,7 @@ var init_schedule2 = __esm(async () => {
     });
     info(colors.green(`Updated permissioned_as for schedule ${schedulePath} to ${email} (username: ${username})`));
   });
-  schedule_default2 = command16;
+  schedule_default2 = command17;
 });
 
 // src/commands/instance/slack.ts
@@ -78231,7 +78358,7 @@ async function decrypt(combinedCiphertext, keyString) {
 var init_local_encryption = () => {};
 
 // src/core/settings.ts
-import process19 from "node:process";
+import process20 from "node:process";
 import { writeFile as writeFile14 } from "node:fs/promises";
 function migrateToGroupedFormat(settings) {
   const result = { name: settings.name ?? "" };
@@ -78514,7 +78641,7 @@ async function pushWorkspaceKey(workspace, _path, key, localKey, opts) {
   }
   if (localKey && key !== localKey) {
     let reencrypt;
-    const explicitSkip = opts?.skipReencrypt || (process19.env.WMILL_NO_REENCRYPT_ON_KEY_CHANGE ?? "").toLowerCase() === "true";
+    const explicitSkip = opts?.skipReencrypt || (process20.env.WMILL_NO_REENCRYPT_ON_KEY_CHANGE ?? "").toLowerCase() === "true";
     if (explicitSkip) {
       reencrypt = false;
       info("Workspace encryption key changed; leaving remote ciphertexts untouched (skip re-encryption requested).");
@@ -78553,7 +78680,7 @@ async function readInstanceSettings(opts) {
   return localSettings;
 }
 async function processInstanceSettings(settings, mode) {
-  const encKey = process19.env.WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY;
+  const encKey = process20.env.WMILL_INSTANCE_LOCAL_ENCRYPTION_KEY;
   if (encKey) {
     const res = [];
     for (const s of settings) {
@@ -78727,7 +78854,7 @@ var init_settings = __esm(async () => {
 // src/commands/instance/instance.ts
 import { writeFile as writeFile15, readdir as readdir9, mkdir as mkdir11, rm as rm5, stat as stat14 } from "node:fs/promises";
 import { appendFile } from "node:fs/promises";
-import * as path20 from "node:path";
+import * as path21 from "node:path";
 async function allInstances() {
   try {
     const file = await getInstancesConfigFilePath();
@@ -78919,7 +79046,7 @@ async function instancePull(opts) {
     if (confirm) {
       if (uChanges > 0) {
         if (opts.folderPerInstance && opts.prefixSettings) {
-          await mkdir11(path20.join(rootDir, opts.prefix), {
+          await mkdir11(path21.join(rootDir, opts.prefix), {
             recursive: true
           });
         }
@@ -78953,10 +79080,10 @@ Pulling all workspaces`);
       info(`
 Pulling workspace ` + remoteWorkspace.id);
       const workspaceName = opts?.folderPerInstance ? instance.prefix + "/" + remoteWorkspace.id : instance.prefix + "_" + remoteWorkspace.id;
-      await mkdir11(path20.join(rootDir, workspaceName), {
+      await mkdir11(path21.join(rootDir, workspaceName), {
         recursive: true
       });
-      process.chdir(path20.join(rootDir, workspaceName));
+      process.chdir(path21.join(rootDir, workspaceName));
       await addWorkspace({
         remote: instance.remote,
         name: workspaceName,
@@ -78991,7 +79118,7 @@ Pulling workspace ` + remoteWorkspace.id);
       if (confirmDelete) {
         for (const workspace of localWorkspacesToDelete) {
           await removeWorkspace(workspace.id, false, {});
-          await rm5(path20.join(rootDir, workspace.dir), {
+          await rm5(path21.join(rootDir, workspace.dir), {
             recursive: true
           });
         }
@@ -79080,12 +79207,12 @@ Pushing all workspaces: ${localWorkspaces.map((x) => x.id).join(", ")}`);
       info(`
 Pushing workspace ` + localWorkspace.id);
       try {
-        process.chdir(path20.join(rootDir, localWorkspace.dir));
+        process.chdir(path21.join(rootDir, localWorkspace.dir));
       } catch (_) {
         throw new Error("Workspace folder not found, are you in the right directory?");
       }
       try {
-        const workspaceSettings = await yamlParseFile(path20.join(process.cwd(), "settings.yaml"));
+        const workspaceSettings = await yamlParseFile(path21.join(process.cwd(), "settings.yaml"));
         await add({
           token: instance.token,
           workspace: undefined,
@@ -79224,7 +79351,7 @@ async function whoami3(opts) {
     error(colors.red(`Failed to retrieve whoami information: ${error2.message}`));
   }
 }
-var import_yaml30, command17, instance_default;
+var import_yaml30, command18, instance_default;
 var init_instance = __esm(async () => {
   init_colors2();
   init_mod3();
@@ -79249,7 +79376,7 @@ var init_instance = __esm(async () => {
     init_workspace()
   ]);
   import_yaml30 = __toESM(require_dist(), 1);
-  command17 = new Command().description("sync local with a remote instance or the opposite (push or pull)").action(async () => {
+  command18 = new Command().description("sync local with a remote instance or the opposite (push or pull)").action(async () => {
     info("4 actions available, add, remove, switch, pull and push. Use -h to display help.");
     const activeInstance = await getActiveInstance({});
     new Table2().header(["name", "remote", "token"]).padding(2).border(true).body((await allInstances()).map((x) => [
@@ -79275,7 +79402,7 @@ var init_instance = __esm(async () => {
     await removeInstance(choice);
     info(colors.green.underline(`Removed instance ${choice}`));
   }).command("switch").complete("instance", async () => (await allInstances()).map((x) => x.name)).arguments("<instance:string:instance>").description("Switch the current instance").action(switchI).command("pull").description("Pull instance settings, users, configs, instance groups and overwrite local").option("--yes", "Pull without needing confirmation").option("--dry-run", "Perform a dry run without making changes").option("--skip-users", "Skip pulling users").option("--skip-settings", "Skip pulling settings").option("--skip-configs", "Skip pulling configs (worker groups)").option("--skip-groups", "Skip pulling instance groups").option("--include-workspaces", "Also pull workspaces").option("--folder-per-instance", "Create a folder per instance").option("--instance <instance:string>", "Name of the instance to pull from, override the active instance").option("--prefix <prefix:string>", "Prefix of the local workspaces to pull, used to create the folders when using --include-workspaces").option("--prefix-settings", "Store instance yamls inside prefixed folders when using --prefix and --folder-per-instance").action(instancePull).command("push").description("Push instance settings, users, configs, group and overwrite remote").option("--yes", "Push without needing confirmation").option("--dry-run", "Perform a dry run without making changes").option("--skip-users", "Skip pushing users").option("--skip-settings", "Skip pushing settings").option("--skip-configs", "Skip pushing configs (worker groups)").option("--skip-groups", "Skip pushing instance groups").option("--include-workspaces", "Also push workspaces").option("--folder-per-instance", "Create a folder per instance").option("--instance <instance:string>", "Name of the instance to push to, override the active instance").option("--prefix <prefix:string>", "Prefix of the local workspaces folders to push").option("--prefix-settings", "Store instance yamls inside prefixed folders when using --prefix and --folder-per-instance").action(instancePush).command("whoami").description("Display information about the currently logged-in user").action(whoami3).command("get-config").description("Dump the current instance config (global settings + worker configs) as YAML").option("-o, --output-file <file:string>", "Write YAML to a file instead of stdout").option("--show-secrets", "Include sensitive fields (license key, JWT secret) without prompting").option("--instance <instance:string>", "Name of the instance, override the active instance").action(getConfig2).command("connect-slack").description("Non-interactively connect Slack at the instance level using a pre-minted bot token (xoxb-...). Produces the same artifacts as the UI OAuth flow: global_settings 'slack' row + encrypted f/slack_bot/global_bot_token variable and resource in the admins workspace.").option("--bot-token <bot_token:string>", "Slack bot token (xoxb-...)", { required: true }).option("--team-id <team_id:string>", "Slack team id", { required: true }).option("--team-name <team_name:string>", "Slack team name", { required: true }).option("--instance <instance:string>", "Instance profile to connect against (defaults to the active instance)").action((opts) => connectSlackInstance2(opts));
-  instance_default = command17;
+  instance_default = command18;
 });
 
 // src/commands/user/user.ts
@@ -79349,8 +79476,8 @@ async function createToken2(opts) {
   }
   info("Token: " + await createToken({ requestBody: {} }));
 }
-async function pushWorkspaceUser(workspace, path21, user, localUser) {
-  const email = removePathPrefix(removeType(path21, "user"), "users");
+async function pushWorkspaceUser(workspace, path22, user, localUser) {
+  const email = removePathPrefix(removeType(path22, "user"), "users");
   debug(`Processing local user ${email}`);
   if (!["operator", "developer", "admin"].includes(localUser.role)) {
     throw new Error(`Invalid role for user ${email}: ${localUser.role}`);
@@ -79413,8 +79540,8 @@ async function pushWorkspaceUser(workspace, path21, user, localUser) {
     }
   }
 }
-async function pushGroup(workspace, path21, group, localGroup) {
-  const name = removePathPrefix(removeType(path21, "group"), "groups");
+async function pushGroup(workspace, path22, group, localGroup) {
+  const name = removePathPrefix(removeType(path22, "group"), "groups");
   debug(`Processing local group ${name}`);
   try {
     const remoteGroup = await getGroup({
@@ -79630,7 +79757,7 @@ async function pushInstanceGroups(opts, preview2 = false) {
     info(colors.green("Groups pushed to the instance"));
   }
 }
-var import_yaml32, INSTANCE_USERS_PATH = "instance_users.yaml", instanceUsersPath, INSTANCE_GROUPS_PATH = "instance_groups.yaml", instanceGroupsPath, command18, user_default;
+var import_yaml32, INSTANCE_USERS_PATH = "instance_users.yaml", instanceUsersPath, INSTANCE_GROUPS_PATH = "instance_groups.yaml", instanceGroupsPath, command19, user_default;
 var init_user = __esm(async () => {
   init_colors2();
   init_mod3();
@@ -79646,29 +79773,29 @@ var init_user = __esm(async () => {
   import_yaml32 = __toESM(require_dist(), 1);
   instanceUsersPath = INSTANCE_USERS_PATH;
   instanceGroupsPath = INSTANCE_GROUPS_PATH;
-  command18 = new Command().description("user related commands").action(list10).command("add", "Create a user").arguments("<email:string> [password:string]").option("--superadmin", "Specify to make the new user superadmin.").option("--company <company:string>", "Specify to set the company of the new user.").option("--name <name:string>", "Specify to set the name of the new user.").action(add3).command("remove", "Delete a user").arguments("<email:string>").action(remove2).command("create-token", "Create a new API token for the authenticated user").option("--email <email:string>", "Specify credentials to use for authentication. This will not be stored. It will only be used to exchange for a token with the API server, which will not be stored either.", {
+  command19 = new Command().description("user related commands").action(list10).command("add", "Create a user").arguments("<email:string> [password:string]").option("--superadmin", "Specify to make the new user superadmin.").option("--company <company:string>", "Specify to set the company of the new user.").option("--name <name:string>", "Specify to set the name of the new user.").action(add3).command("remove", "Delete a user").arguments("<email:string>").action(remove2).command("create-token", "Create a new API token for the authenticated user").option("--email <email:string>", "Specify credentials to use for authentication. This will not be stored. It will only be used to exchange for a token with the API server, which will not be stored either.", {
     depends: ["password"]
   }).option("--password <password:string>", "Specify credentials to use for authentication. This will not be stored. It will only be used to exchange for a token with the API server, which will not be stored either.", {
     depends: ["email"]
   }).action(createToken2);
-  user_default = command18;
+  user_default = command19;
 });
 
 // src/commands/dependencies/dependencies.ts
-import fs15 from "node:fs";
+import fs16 from "node:fs";
 async function push9(opts, filePath) {
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
-  if (!fs15.existsSync(filePath)) {
+  if (!fs16.existsSync(filePath)) {
     throw new Error(`File not found: ${filePath}`);
   }
   const content = readTextFileSync(filePath);
   await pushWorkspaceDependencies(workspace.workspaceId, filePath, null, content);
 }
-async function pushWorkspaceDependencies(workspace, path21, _befObj, newDependenciesContent) {
-  const res = workspaceDependenciesPathToLanguageAndFilename(path21);
+async function pushWorkspaceDependencies(workspace, path22, _befObj, newDependenciesContent) {
+  const res = workspaceDependenciesPathToLanguageAndFilename(path22);
   if (!res) {
-    throw new Error(`Unknown workspace dependencies file format: ${path21}. ` + `Valid files: package.json, requirements.in, composer.json, go.mod, modules.json`);
+    throw new Error(`Unknown workspace dependencies file format: ${path22}. ` + `Valid files: package.json, requirements.in, composer.json, go.mod, modules.json`);
   }
   const { language, name } = res;
   const displayName = name ? `named dependencies "${name}"` : `workspace default dependencies`;
@@ -79700,7 +79827,7 @@ async function pushWorkspaceDependencies(workspace, path21, _befObj, newDependen
   });
   info(colors.green(`Successfully pushed ${displayName} for ${language}`));
 }
-var command19, dependencies_default;
+var command20, dependencies_default;
 var init_dependencies = __esm(async () => {
   init_colors2();
   init_mod3();
@@ -79712,15 +79839,15 @@ var init_dependencies = __esm(async () => {
     init_metadata(),
     init_utils()
   ]);
-  command19 = new Command().alias("deps").description("workspace dependencies related commands").command("push", "Push workspace dependencies from a local file").arguments("<file_path:string>").action(push9);
-  dependencies_default = command19;
+  command20 = new Command().alias("deps").description("workspace dependencies related commands").command("push", "Push workspace dependencies from a local file").arguments("<file_path:string>").action(push9);
+  dependencies_default = command20;
 });
 
 // src/commands/trigger/trigger.ts
 import { mkdir as mkdir12, stat as stat15, writeFile as writeFile17 } from "node:fs/promises";
 import { dirname as dirname17 } from "node:path";
 import { sep as SEP18 } from "node:path";
-async function getTrigger(triggerType, workspace, path21) {
+async function getTrigger(triggerType, workspace, path22) {
   const triggerFunctions = {
     http: getHttpTrigger,
     websocket: getWebsocketTrigger,
@@ -79735,10 +79862,10 @@ async function getTrigger(triggerType, workspace, path21) {
     email: getEmailTrigger
   };
   const triggerFunction = triggerFunctions[triggerType];
-  const trigger = await triggerFunction({ workspace, path: path21 });
+  const trigger = await triggerFunction({ workspace, path: path22 });
   return trigger;
 }
-async function updateTrigger(triggerType, workspace, path21, trigger) {
+async function updateTrigger(triggerType, workspace, path22, trigger) {
   const triggerFunctions = {
     http: updateHttpTrigger,
     websocket: updateWebsocketTrigger,
@@ -79753,9 +79880,9 @@ async function updateTrigger(triggerType, workspace, path21, trigger) {
     email: updateEmailTrigger
   };
   const triggerFunction = triggerFunctions[triggerType];
-  await triggerFunction({ workspace, path: path21, requestBody: trigger });
+  await triggerFunction({ workspace, path: path22, requestBody: trigger });
 }
-async function createTrigger(triggerType, workspace, path21, trigger) {
+async function createTrigger(triggerType, workspace, path22, trigger) {
   const triggerFunctions = {
     http: createHttpTrigger,
     websocket: createWebsocketTrigger,
@@ -79770,16 +79897,16 @@ async function createTrigger(triggerType, workspace, path21, trigger) {
     email: createEmailTrigger
   };
   const triggerFunction = triggerFunctions[triggerType];
-  await triggerFunction({ workspace, path: path21, requestBody: trigger });
+  await triggerFunction({ workspace, path: path22, requestBody: trigger });
 }
-async function pushTrigger(triggerType, workspace, path21, trigger, localTrigger, permissionedAsContext) {
-  path21 = removeType(path21, triggerType + "_trigger").replaceAll(SEP18, "/");
-  debug(`Processing local ${triggerType} trigger ${path21}`);
+async function pushTrigger(triggerType, workspace, path22, trigger, localTrigger, permissionedAsContext) {
+  path22 = removeType(path22, triggerType + "_trigger").replaceAll(SEP18, "/");
+  debug(`Processing local ${triggerType} trigger ${path22}`);
   try {
-    trigger = await getTrigger(triggerType, workspace, path21);
-    debug(`${triggerType} trigger ${path21} exists on remote`);
+    trigger = await getTrigger(triggerType, workspace, path22);
+    debug(`${triggerType} trigger ${path22} exists on remote`);
   } catch {
-    debug(`${triggerType} trigger ${path21} does not exist on remote`);
+    debug(`${triggerType} trigger ${path22} does not exist on remote`);
   }
   delete localTrigger.has_permissioned_as;
   const preserveFields = {};
@@ -79788,33 +79915,33 @@ async function pushTrigger(triggerType, workspace, path21, trigger, localTrigger
       preserveFields.preserve_permissioned_as = true;
       if (trigger.permissioned_as) {
         preserveFields.permissioned_as = trigger.permissioned_as;
-        info(`Preserving ${trigger.permissioned_as} as permissioned_as for trigger ${path21}`);
+        info(`Preserving ${trigger.permissioned_as} as permissioned_as for trigger ${path22}`);
       }
     }
   }
   if (trigger) {
     if (isSuperset(localTrigger, trigger)) {
-      debug(`${triggerType} trigger ${path21} is up to date`);
+      debug(`${triggerType} trigger ${path22} is up to date`);
       return;
     }
-    debug(`${triggerType} trigger ${path21} is not up-to-date, updating...`);
+    debug(`${triggerType} trigger ${path22} is not up-to-date, updating...`);
     try {
-      await updateTrigger(triggerType, workspace, path21, {
+      await updateTrigger(triggerType, workspace, path22, {
         ...localTrigger,
         ...preserveFields,
-        path: path21
+        path: path22
       });
     } catch (e) {
       console.error(e.body);
       throw e;
     }
   } else {
-    console.log(colors.bold.yellow(`Creating new ${triggerType} trigger: ${path21}`));
+    console.log(colors.bold.yellow(`Creating new ${triggerType} trigger: ${path22}`));
     try {
-      await createTrigger(triggerType, workspace, path21, {
+      await createTrigger(triggerType, workspace, path22, {
         ...localTrigger,
         ...preserveFields,
-        path: path21
+        path: path22
       });
     } catch (e) {
       console.error(e.body);
@@ -79899,8 +80026,8 @@ async function pushNativeTrigger(workspace, filePath, _remoteTrigger, localTrigg
     }
   }
 }
-async function newTrigger(opts, path21) {
-  if (!validatePath(path21)) {
+async function newTrigger(opts, path22) {
+  if (!validatePath(path22)) {
     return;
   }
   if (!opts.kind) {
@@ -79910,7 +80037,7 @@ async function newTrigger(opts, path21) {
     throw new Error("Invalid trigger kind: " + opts.kind + ". Valid kinds: " + TRIGGER_TYPES.join(", "));
   }
   const kind = opts.kind;
-  const filePath = `${path21}.${kind}_trigger.yaml`;
+  const filePath = `${path22}.${kind}_trigger.yaml`;
   try {
     await stat15(filePath);
     throw new Error("File already exists: " + filePath);
@@ -79946,7 +80073,7 @@ function printTriggerDetails(trigger, kind) {
     console.log(colors.bold(label + ":") + " " + display);
   }
 }
-async function get8(opts, path21) {
+async function get8(opts, path22) {
   if (opts.json)
     setSilent(true);
   const workspace = await resolveWorkspace(opts);
@@ -79955,7 +80082,7 @@ async function get8(opts, path21) {
     if (!checkIfValidTrigger(opts.kind)) {
       throw new Error("Invalid trigger kind: " + opts.kind + ". Valid kinds: " + TRIGGER_TYPES.join(", "));
     }
-    const trigger = await getTrigger(opts.kind, workspace.workspaceId, path21);
+    const trigger = await getTrigger(opts.kind, workspace.workspaceId, path22);
     if (opts.json) {
       console.log(JSON.stringify(trigger));
     } else {
@@ -79966,12 +80093,12 @@ async function get8(opts, path21) {
   const matches = [];
   for (const kind of TRIGGER_TYPES) {
     try {
-      const trigger = await getTrigger(kind, workspace.workspaceId, path21);
+      const trigger = await getTrigger(kind, workspace.workspaceId, path22);
       matches.push({ kind, trigger });
     } catch {}
   }
   if (matches.length === 0) {
-    throw new Error("No trigger found at path: " + path21);
+    throw new Error("No trigger found at path: " + path22);
   }
   if (matches.length === 1) {
     const { kind, trigger } = matches[0];
@@ -79982,7 +80109,7 @@ async function get8(opts, path21) {
     }
     return;
   }
-  console.log("Multiple triggers found at path " + path21 + ":");
+  console.log("Multiple triggers found at path " + path22 + ":");
   for (const m of matches) {
     console.log("  - " + m.kind);
   }
@@ -80082,7 +80209,7 @@ async function push10(opts, filePath, remotePath) {
   await pushTrigger(triggerKind, workspace.workspaceId, remotePath, undefined, parseFromFile(filePath));
   console.log(colors.bold.underline.green("Trigger pushed"));
 }
-var import_yaml34, triggerTemplates, TRIGGER_SKIP_FIELDS, command20, trigger_default;
+var import_yaml34, triggerTemplates, TRIGGER_SKIP_FIELDS, command21, trigger_default;
 var init_trigger = __esm(async () => {
   init_services_gen();
   init_mod3();
@@ -80195,7 +80322,7 @@ var init_trigger = __esm(async () => {
     }
   };
   TRIGGER_SKIP_FIELDS = new Set(["workspace_id", "extra_perms", "edited_by", "edited_at"]);
-  command20 = new Command().description("trigger related commands").option("--json", "Output as JSON (for piping to jq)").action(list11).command("list", "list all triggers").option("--json", "Output as JSON (for piping to jq)").action(list11).command("get", "get a trigger's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").option("--kind <kind:string>", "Trigger kind (http, websocket, kafka, nats, postgres, mqtt, amqp, sqs, gcp, azure, email). Recommended for faster lookup").action(get8).command("new", "create a new trigger locally").arguments("<path:string>").option("--kind <kind:string>", "Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, amqp, sqs, gcp, azure, email)").action(newTrigger).command("push", "push a local trigger spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").action(push10).command("set-permissioned-as", "Set the email (run-as user) for a trigger (requires admin or wm_deployers group)").arguments("<path:string> <email:string>").option("--kind <kind:string>", "Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, amqp, sqs, gcp, azure, email)").action(async (opts, triggerPath, email) => {
+  command21 = new Command().description("trigger related commands").option("--json", "Output as JSON (for piping to jq)").action(list11).command("list", "list all triggers").option("--json", "Output as JSON (for piping to jq)").action(list11).command("get", "get a trigger's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").option("--kind <kind:string>", "Trigger kind (http, websocket, kafka, nats, postgres, mqtt, amqp, sqs, gcp, azure, email). Recommended for faster lookup").action(get8).command("new", "create a new trigger locally").arguments("<path:string>").option("--kind <kind:string>", "Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, amqp, sqs, gcp, azure, email)").action(newTrigger).command("push", "push a local trigger spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").action(push10).command("set-permissioned-as", "Set the email (run-as user) for a trigger (requires admin or wm_deployers group)").arguments("<path:string> <email:string>").option("--kind <kind:string>", "Trigger kind (required: http, websocket, kafka, nats, postgres, mqtt, amqp, sqs, gcp, azure, email)").action(async (opts, triggerPath, email) => {
     const workspace = await resolveWorkspace(opts);
     await requireLogin(opts);
     if (!opts.kind) {
@@ -80218,11 +80345,11 @@ var init_trigger = __esm(async () => {
     });
     info(colors.green(`Updated permissioned_as for ${opts.kind} trigger ${triggerPath} to ${email} (username: ${username})`));
   });
-  trigger_default = command20;
+  trigger_default = command21;
 });
 
 // src/types.ts
-import * as path21 from "node:path";
+import * as path22 from "node:path";
 import { sep as SEP19 } from "node:path";
 function isSuperset(subset, superset) {
   return Object.keys(subset).every((key) => {
@@ -80266,11 +80393,11 @@ function showDiff(local, remote) {
   }
   info(finalString);
 }
-function showConflict(path22, local, remote) {
-  info(colors.yellow(`- ${path22}`));
+function showConflict(path23, local, remote) {
+  info(colors.yellow(`- ${path23}`));
   let isEncryptionKey = false;
   try {
-    isEncryptionKey = getTypeStrFromPath(path22) === "encryption_key";
+    isEncryptionKey = getTypeStrFromPath(path23) === "encryption_key";
   } catch {}
   if (isEncryptionKey) {
     showDiff(redactEncryptionKey(local), redactEncryptionKey(remote));
@@ -80427,7 +80554,7 @@ function getTypeStrFromPath(p) {
   if (isFileResource(p) || isFilesetResource(p)) {
     return "resource";
   }
-  const parsed = path21.parse(p);
+  const parsed = path22.parse(p);
   if (parsed.ext == ".go" || parsed.ext == ".ts" || parsed.ext == ".sh" || parsed.ext == ".py" || parsed.ext == ".sql" || parsed.ext == ".gql" || parsed.ext == ".ps1" || parsed.ext == ".js" || parsed.ext == ".php" || parsed.ext == ".rs" || parsed.ext == ".cs" || parsed.ext == ".nu" || parsed.ext == ".java" || parsed.ext == ".rb" || parsed.ext == ".r" || parsed.ext == ".yml" && parsed.name.split(".").pop() == "playbook" || isDbtDescriptorPath(p)) {
     return "script";
   }
@@ -80451,7 +80578,7 @@ function getTypeStrFromPath(p) {
   }
 }
 function removeType(str, type) {
-  const normalizedStr = path21.normalize(str).replaceAll(SEP19, "/");
+  const normalizedStr = path22.normalize(str).replaceAll(SEP19, "/");
   if (normalizedStr.endsWith("." + type + ".yaml") || normalizedStr.endsWith("." + type + ".json")) {
     return normalizedStr.slice(0, normalizedStr.length - type.length - 6);
   }
@@ -80461,7 +80588,7 @@ function removeType(str, type) {
   return normalizedStr;
 }
 function extractNativeTriggerInfo(p) {
-  const normalizedPath = path21.normalize(p).replaceAll(SEP19, "/");
+  const normalizedPath = path22.normalize(p).replaceAll(SEP19, "/");
   const withoutExt = normalizedPath.replace(/\.(json|yaml)$/, "");
   const match2 = withoutExt.match(/^(.+)\.(flow|script)\.([^.]+)\.(\w+)_native_trigger$/);
   if (!match2) {
@@ -80475,8 +80602,8 @@ function extractNativeTriggerInfo(p) {
   };
 }
 function removePathPrefix(str, prefix) {
-  const normalizedStr = path21.normalize(str).replaceAll(SEP19, "/");
-  const normalizedPrefix = path21.normalize(prefix).replaceAll(SEP19, "/");
+  const normalizedStr = path22.normalize(str).replaceAll(SEP19, "/");
+  const normalizedPrefix = path22.normalize(prefix).replaceAll(SEP19, "/");
   if (normalizedStr === normalizedPrefix) {
     return "";
   }
@@ -80652,7 +80779,7 @@ var init_local_path_scripts = __esm(async () => {
 
 // src/commands/flow/flow.ts
 import { dirname as dirname18, sep as SEP20 } from "node:path";
-import { mkdirSync as mkdirSync7, writeFileSync as writeFileSync7 } from "node:fs";
+import { mkdirSync as mkdirSync8, writeFileSync as writeFileSync8 } from "node:fs";
 function normalizeOptionalString(value) {
   return typeof value === "string" && value.trim() === "" ? undefined : value ?? undefined;
 }
@@ -80694,12 +80821,12 @@ function warnAboutLocalPathScriptDivergence(divergence) {
   const details = [];
   if (divergence.changed.length > 0) {
     details.push(`These workspace scripts differ from the deployed version:
-${divergence.changed.map((path22) => `- ${path22}`).join(`
+${divergence.changed.map((path23) => `- ${path23}`).join(`
 `)}`);
   }
   if (divergence.missing.length > 0) {
     details.push(`These scripts do not exist in the workspace yet:
-${divergence.missing.map((path22) => `- ${path22}`).join(`
+${divergence.missing.map((path23) => `- ${path23}`).join(`
 `)}`);
   }
   warn(`Using local PathScript files for flow preview.
@@ -80748,7 +80875,7 @@ async function pushFlow(workspace, remotePath, localPath, message, permissionedA
     localPath += SEP20;
   }
   const localFlow = await yamlParseFile(localPath + "flow.yaml");
-  const fileReader = async (path22) => await readTextFile(localPath + path22);
+  const fileReader = async (path23) => await readTextFile(localPath + path23);
   const missingFiles = [];
   await replaceInlineScripts(localFlow.value.modules, fileReader, exports_log, localPath, SEP20, undefined, missingFiles);
   if (localFlow.value.failure_module) {
@@ -80850,14 +80977,14 @@ async function list12(opts) {
     new Table2().header(["path", "summary", "edited by"]).padding(2).border(true).body(total.map((x) => [x.path, x.summary, x.edited_by])).render();
   }
 }
-async function get9(opts, path22) {
+async function get9(opts, path23) {
   if (opts.json)
     setSilent(true);
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
   const f = await getFlowByPath({
     workspace: workspace.workspaceId,
-    path: path22
+    path: path23
   });
   if (opts.json) {
     console.log(JSON.stringify(f));
@@ -80895,7 +81022,7 @@ async function get9(opts, path22) {
     }
   }
 }
-async function run3(opts, path22) {
+async function run3(opts, path23) {
   if (opts.silent) {
     setSilent(true);
   }
@@ -80906,7 +81033,7 @@ async function run3(opts, path22) {
     try {
       const flow = await getFlowByPath({
         workspace: workspace.workspaceId,
-        path: path22
+        path: path23
       });
       validateRequiredArgs(flow.schema);
     } catch (e) {
@@ -80917,7 +81044,7 @@ async function run3(opts, path22) {
   }
   const id = await runFlowByPath({
     workspace: workspace.workspaceId,
-    path: path22,
+    path: path23,
     tag: opts.tag,
     requestBody: input
   });
@@ -80982,7 +81109,7 @@ async function run3(opts, path22) {
             forLoopFailed = refreshedModule.type === "Failure";
             break;
           }
-          await new Promise((resolve10) => setTimeout(resolve10, 200));
+          await new Promise((resolve11) => setTimeout(resolve11, 200));
         }
         if (forLoopFailed)
           break;
@@ -80998,7 +81125,7 @@ async function run3(opts, path22) {
         info(colors.dim(status));
         lastStatus = status;
       }
-      await new Promise((resolve10, _) => setTimeout(() => resolve10(undefined), 100));
+      await new Promise((resolve11, _) => setTimeout(() => resolve11(undefined), 100));
       if (isCompleted)
         break;
       continue;
@@ -81034,7 +81161,7 @@ async function run3(opts, path22) {
       break;
     } catch {
       retries++;
-      await new Promise((resolve10) => setTimeout(resolve10, 100));
+      await new Promise((resolve11) => setTimeout(resolve11, 100));
     }
   }
   if (retries >= MAX_RETRIES) {
@@ -81064,7 +81191,7 @@ async function preview2(opts, flowPath) {
     flowPath += SEP20;
   }
   const localFlow = await yamlParseFile(flowPath + "flow.yaml");
-  const fileReader = async (path22) => await readTextFile(flowPath + path22);
+  const fileReader = async (path23) => await readTextFile(flowPath + path23);
   await replaceInlineScripts(localFlow.value.modules, fileReader, exports_log, flowPath, SEP20);
   if (localFlow.value.failure_module) {
     await replaceInlineScripts([localFlow.value.failure_module], fileReader, exports_log, flowPath, SEP20);
@@ -81329,7 +81456,7 @@ async function bootstrap2(opts, flowPath) {
   }
   await loadNonDottedPathsSetting();
   const flowDirFullPath = buildFolderPath(flowPath, "flow");
-  mkdirSync7(flowDirFullPath, { recursive: true });
+  mkdirSync8(flowDirFullPath, { recursive: true });
   const newFlowDefinition = defaultFlowDefinition();
   if (opts.summary !== undefined) {
     newFlowDefinition.summary = opts.summary;
@@ -81340,7 +81467,7 @@ async function bootstrap2(opts, flowPath) {
   const newFlowDefinitionYaml = import_yaml37.stringify(newFlowDefinition);
   const metadataFile = getMetadataFileName("flow", "yaml");
   const flowYamlPath = `${flowDirFullPath}/${metadataFile}`;
-  writeFileSync7(flowYamlPath, newFlowDefinitionYaml, { flag: "wx", encoding: "utf-8" });
+  writeFileSync8(flowYamlPath, newFlowDefinitionYaml, { flag: "wx", encoding: "utf-8" });
   info(colors.green(`Created flow at ${flowDirFullPath}`));
   info("");
   info(colors.bold("To preview this flow:"));
@@ -81393,7 +81520,7 @@ async function showVersion(opts, flowPath, version) {
     console.log(JSON.stringify(flow.value, null, 2));
   }
 }
-var import_yaml37, alreadySynced3, command21, flow_default;
+var import_yaml37, alreadySynced3, command22, flow_default;
 var init_flow = __esm(async () => {
   init_colors2();
   init_mod3();
@@ -81419,7 +81546,7 @@ var init_flow = __esm(async () => {
   ]);
   import_yaml37 = __toESM(require_dist(), 1);
   alreadySynced3 = [];
-  command21 = new Command().description("flow related commands").option("--show-archived", "Enable archived flows in output").option("--json", "Output as JSON (for piping to jq)").action(list12).command("list", "list all flows").option("--show-archived", "Enable archived flows in output").option("--json", "Output as JSON (for piping to jq)").action(list12).command("get", "get a flow's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get9).command("push", "push a local flow spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").option("--message <message:string>", "Deployment message").action(push11).command("run", "run a flow by path.").arguments("<path:string>").option("-d --data <data:string>", "Inputs specified as a JSON string or a file using @<filename> or stdin using @-.").option("-s --silent", "Do not ouput anything other then the final output. Useful for scripting.").option("--tag <tag:string>", "Override the worker tag the run is dispatched to (e.g. to route it to dev workers instead of the flow's default tag).").action(run3).command("preview", "preview a local flow without deploying it. Runs the flow definition from local files and uses local PathScripts by default. Pass --step <id> to run only one module in isolation (resolves nested steps inside branchone/branchall/forloopflow/whileloopflow plus the special preprocessor/failure modules; supported step types: rawscript, script, flow).").arguments("<flow_path:string>").option("-d --data <data:string>", "Inputs specified as a JSON string or a file using @<filename> or stdin using @-.").option("-s --silent", "Do not output anything other then the final output. Useful for scripting.").option("--remote", "Use deployed workspace scripts for PathScript steps instead of local files.").option("--step <step_id:string>", "Run only the named step instead of the whole flow. Honors --data as the step's args and --remote / local-PathScript resolution the same way the full-flow preview does.").option("--tag <tag:string>", "Override the worker tag the preview is dispatched to (e.g. to route it to dev workers instead of the flow's default tag).").action(preview2).command("generate-locks", 'DEPRECATED: re-generate flow lock files. Use "wmill generate-metadata" instead.').arguments("[flow:file]").option("--yes", "Skip confirmation prompt").option("--dry-run", "Perform a dry run without making changes").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string)").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which file to NOT take into account.").action(generateLocks).command("new", "create a new empty flow").arguments("<flow_path:string>").option("--summary <summary:string>", "flow summary").option("--description <description:string>", "flow description").action(bootstrap2).command("bootstrap", "create a new empty flow (alias for new)").arguments("<flow_path:string>").option("--summary <summary:string>", "flow summary").option("--description <description:string>", "flow description").action(bootstrap2).command("history", "Show version history for a flow").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(history2).command("show-version", "Show a specific version of a flow").arguments("<path:string> <version:string>").option("--json", "Output as JSON (for piping to jq)").action(showVersion).command("set-permissioned-as", "Set the on_behalf_of_email for a flow (requires admin or wm_deployers group)").arguments("<path:string> <email:string>").action(async (opts, flowPath, email) => {
+  command22 = new Command().description("flow related commands").option("--show-archived", "Enable archived flows in output").option("--json", "Output as JSON (for piping to jq)").action(list12).command("list", "list all flows").option("--show-archived", "Enable archived flows in output").option("--json", "Output as JSON (for piping to jq)").action(list12).command("get", "get a flow's details").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(get9).command("push", "push a local flow spec. This overrides any remote versions.").arguments("<file_path:string> <remote_path:string>").option("--message <message:string>", "Deployment message").action(push11).command("run", "run a flow by path.").arguments("<path:string>").option("-d --data <data:string>", "Inputs specified as a JSON string or a file using @<filename> or stdin using @-.").option("-s --silent", "Do not ouput anything other then the final output. Useful for scripting.").option("--tag <tag:string>", "Override the worker tag the run is dispatched to (e.g. to route it to dev workers instead of the flow's default tag).").action(run3).command("preview", "preview a local flow without deploying it. Runs the flow definition from local files and uses local PathScripts by default. Pass --step <id> to run only one module in isolation (resolves nested steps inside branchone/branchall/forloopflow/whileloopflow plus the special preprocessor/failure modules; supported step types: rawscript, script, flow).").arguments("<flow_path:string>").option("-d --data <data:string>", "Inputs specified as a JSON string or a file using @<filename> or stdin using @-.").option("-s --silent", "Do not output anything other then the final output. Useful for scripting.").option("--remote", "Use deployed workspace scripts for PathScript steps instead of local files.").option("--step <step_id:string>", "Run only the named step instead of the whole flow. Honors --data as the step's args and --remote / local-PathScript resolution the same way the full-flow preview does.").option("--tag <tag:string>", "Override the worker tag the preview is dispatched to (e.g. to route it to dev workers instead of the flow's default tag).").action(preview2).command("generate-locks", 'DEPRECATED: re-generate flow lock files. Use "wmill generate-metadata" instead.').arguments("[flow:file]").option("--yes", "Skip confirmation prompt").option("--dry-run", "Perform a dry run without making changes").option("-i --includes <patterns:file[]>", "Comma separated patterns to specify which file to take into account (among files that are compatible with windmill). Patterns can include * (any string until '/') and ** (any string)").option("-e --excludes <patterns:file[]>", "Comma separated patterns to specify which file to NOT take into account.").action(generateLocks).command("new", "create a new empty flow").arguments("<flow_path:string>").option("--summary <summary:string>", "flow summary").option("--description <description:string>", "flow description").action(bootstrap2).command("bootstrap", "create a new empty flow (alias for new)").arguments("<flow_path:string>").option("--summary <summary:string>", "flow summary").option("--description <description:string>", "flow description").action(bootstrap2).command("history", "Show version history for a flow").arguments("<path:string>").option("--json", "Output as JSON (for piping to jq)").action(history2).command("show-version", "Show a specific version of a flow").arguments("<path:string> <version:string>").option("--json", "Output as JSON (for piping to jq)").action(showVersion).command("set-permissioned-as", "Set the on_behalf_of_email for a flow (requires admin or wm_deployers group)").arguments("<path:string> <email:string>").action(async (opts, flowPath, email) => {
     const workspace = await resolveWorkspace(opts);
     await requireLogin(opts);
     const remote = await getFlowByPath({
@@ -81442,7 +81569,7 @@ var init_flow = __esm(async () => {
     });
     info(colors.green(`Updated permissioned_as for flow ${flowPath} to ${email}`));
   });
-  flow_default = command21;
+  flow_default = command22;
 });
 
 // src/commands/gitsync-settings/converter.ts
@@ -81585,7 +81712,7 @@ class GitSyncSettingsConverter {
 }
 
 // src/commands/gitsync-settings/legacySettings.ts
-import process20 from "node:process";
+import process21 from "node:process";
 async function handleLegacyRepositoryMigration(selectedRepo, gitSyncSettings, workspace, opts, operationName = "operation") {
   if (selectedRepo.settings) {
     return selectedRepo;
@@ -81595,7 +81722,7 @@ async function handleLegacyRepositoryMigration(selectedRepo, gitSyncSettings, wo
   }
   const workspaceIncludePath = gitSyncSettings.include_path;
   const workspaceIncludeType = gitSyncSettings.include_type;
-  if (!!process20.stdout.isTTY && !opts.yes) {
+  if (!!process21.stdout.isTTY && !opts.yes) {
     console.log(colors.yellow(`
 ⚠️  Legacy git-sync settings detected!`));
     console.log(`
@@ -81701,7 +81828,7 @@ Repository "${selectedRepo.git_repo_resource_path}" has legacy settings format.`
       console.error(`   wmill gitsync-settings push
 `);
     }
-    process20.exit(1);
+    process21.exit(1);
   }
 }
 var init_legacySettings = __esm(async () => {
@@ -81746,8 +81873,8 @@ function outputResult(opts, result) {
     error(colors.red(result.error));
   }
 }
-function normalizeRepoPath(path22) {
-  return path22.replace(/^\$res:/, "");
+function normalizeRepoPath(path23) {
+  return path23.replace(/^\$res:/, "");
 }
 function getOrCreateBranchConfig(config, branchName) {
   if (!config.workspaces) {
@@ -82158,14 +82285,14 @@ var init_pull2 = __esm(async () => {
 });
 
 // src/commands/gitsync-settings/push.ts
-import process21 from "node:process";
+import process22 from "node:process";
 async function pushGitSyncSettings(opts) {
   try {
     await validateBranchConfiguration({ yes: opts.yes });
   } catch (error2) {
     if (error2 instanceof Error && error2.message.includes("overrides")) {
       error(error2.message);
-      process21.exit(1);
+      process22.exit(1);
     }
     throw error2;
   }
@@ -82175,7 +82302,7 @@ async function pushGitSyncSettings(opts) {
     const wmillYamlPath = getWmillYamlPath();
     if (!wmillYamlPath) {
       error(colors.red("No wmill.yaml file found. Please run 'wmill init' first to create the configuration file."));
-      process21.exit(1);
+      process22.exit(1);
     }
     const localConfig = await readConfigFile();
     let settings;
@@ -82291,7 +82418,7 @@ async function pushGitSyncSettings(opts) {
           displayChanges(changes);
         }
       }
-      if (!opts.yes && !!process21.stdin.isTTY) {
+      if (!opts.yes && !!process22.stdin.isTTY) {
         const confirmed = await Confirm.prompt({
           message: `Do you want to apply these changes to the remote?`,
           default: true
@@ -82421,7 +82548,7 @@ __export(exports_gitsync_settings, {
   gitSyncStatus: () => gitSyncStatus,
   default: () => gitsync_settings_default
 });
-var command23, gitsync_settings_default;
+var command24, gitsync_settings_default;
 var init_gitsync_settings = __esm(async () => {
   init_mod3();
   await __promiseAll([
@@ -82429,8 +82556,8 @@ var init_gitsync_settings = __esm(async () => {
     init_push(),
     init_status()
   ]);
-  command23 = new Command().description("Manage git-sync settings between local wmill.yaml and Windmill backend").command("pull").description("Pull git-sync settings from Windmill backend to local wmill.yaml").option("--repository <repo:string>", "Specify repository path (e.g., u/user/repo)").option("--default", "Write settings to top-level defaults instead of overrides").option("--replace", "Replace existing settings (non-interactive mode)").option("--override", "Add branch-specific override (non-interactive mode)").option("--diff", "Show differences without applying changes").option("--json-output", "Output in JSON format").option("--with-backend-settings <json:string>", "Use provided JSON settings instead of querying backend (for testing)").option("--yes", "Skip interactive prompts and use default behavior").option("--promotion <branch:string>", "Use promotionOverrides from the specified branch instead of regular overrides").action(pullGitSyncSettings).command("push").description("Push git-sync settings from local wmill.yaml to Windmill backend").option("--repository <repo:string>", "Specify repository path (e.g., u/user/repo)").option("--diff", "Show what would be pushed without applying changes").option("--json-output", "Output in JSON format").option("--with-backend-settings <json:string>", "Use provided JSON settings instead of querying backend (for testing)").option("--yes", "Skip interactive prompts and use default behavior").option("--promotion <branch:string>", "Use promotionOverrides from the specified branch instead of regular overrides").action(pushGitSyncSettings).command("status").description("Report how local changes deploy to the workspace (git push vs wmill sync push)").option("--json-output", "Output in JSON format").action(gitSyncStatus);
-  gitsync_settings_default = command23;
+  command24 = new Command().description("Manage git-sync settings between local wmill.yaml and Windmill backend").command("pull").description("Pull git-sync settings from Windmill backend to local wmill.yaml").option("--repository <repo:string>", "Specify repository path (e.g., u/user/repo)").option("--default", "Write settings to top-level defaults instead of overrides").option("--replace", "Replace existing settings (non-interactive mode)").option("--override", "Add branch-specific override (non-interactive mode)").option("--diff", "Show differences without applying changes").option("--json-output", "Output in JSON format").option("--with-backend-settings <json:string>", "Use provided JSON settings instead of querying backend (for testing)").option("--yes", "Skip interactive prompts and use default behavior").option("--promotion <branch:string>", "Use promotionOverrides from the specified branch instead of regular overrides").action(pullGitSyncSettings).command("push").description("Push git-sync settings from local wmill.yaml to Windmill backend").option("--repository <repo:string>", "Specify repository path (e.g., u/user/repo)").option("--diff", "Show what would be pushed without applying changes").option("--json-output", "Output in JSON format").option("--with-backend-settings <json:string>", "Use provided JSON settings instead of querying backend (for testing)").option("--yes", "Skip interactive prompts and use default behavior").option("--promotion <branch:string>", "Use promotionOverrides from the specified branch instead of regular overrides").action(pushGitSyncSettings).command("status").description("Report how local changes deploy to the workspace (git push vs wmill sync push)").option("--json-output", "Output in JSON format").action(gitSyncStatus);
+  gitsync_settings_default = command24;
 });
 
 // src/guidance/core.ts
@@ -89344,6 +89471,9 @@ app related commands
   - \`--recording\` - Frame the app in a shell with a Record button, to capture a replayable session recording of the app under development
 - \`app lint [app_folder:string]\` - Lint a raw app folder to validate structure and buildability
   - \`--fix\` - Attempt to fix common issues (not implemented yet)
+- \`app bundle [app_folder:string]\` - Bundle a raw app folder to js/css without deploying it
+  - \`--out <dir:string>\` - Directory to write bundle.js and bundle.css into (default: <app_folder>/dist)
+  - \`--no-minify\` - Skip minification
 - \`app new\` - create a new raw app from a template
   - \`--summary <summary:string>\` - App summary (short description). Skips the prompt when provided. Triggers non-interactive mode.
   - \`--path <path:string>\` - App path (e.g., f/folder/my_app or u/username/my_app). Skips the prompt when provided. Triggers non-interactive mode.
@@ -91738,17 +91868,17 @@ async function warnIfPromptsStale(opts) {
     return;
   const cwd = opts?.cwd ?? process.cwd();
   let fileName = AGENTS_WMILL_FILENAME;
-  let path23 = `${cwd}/${fileName}`;
-  if (!await stat18(path23).catch(() => null)) {
+  let path24 = `${cwd}/${fileName}`;
+  if (!await stat18(path24).catch(() => null)) {
     fileName = LEGACY_AGENTS_CLI_FILENAME;
-    path23 = `${cwd}/${fileName}`;
-    if (!await stat18(path23).catch(() => null)) {
+    path24 = `${cwd}/${fileName}`;
+    if (!await stat18(path24).catch(() => null)) {
       return;
     }
   }
   let content;
   try {
-    content = await readTextFile(path23);
+    content = await readTextFile(path24);
   } catch {
     return;
   }
@@ -91794,9 +91924,9 @@ __export(exports_tsconfig, {
 });
 import { execSync as execSync6 } from "node:child_process";
 import { createHash as createHash2 } from "node:crypto";
-import { existsSync as existsSync17, readFileSync as readFileSync5, writeFileSync as writeFileSync8 } from "node:fs";
-import path23 from "node:path";
-import process24 from "node:process";
+import { existsSync as existsSync18, readFileSync as readFileSync5, writeFileSync as writeFileSync9 } from "node:fs";
+import path24 from "node:path";
+import process25 from "node:process";
 function buildManagedTsconfig() {
   const paths = {};
   for (const dir of WORKSPACE_IMPORT_DIRS) {
@@ -91847,7 +91977,7 @@ async function refreshTsconfig(opts) {
   const assumeYes = opts?.yes === true;
   const mode = {
     assumeYes,
-    interactive: !!process24.stdin.isTTY && !assumeYes
+    interactive: !!process25.stdin.isTTY && !assumeYes
   };
   await refreshManagedTsconfig(defaultTs2, mode);
   if (defaultTs2 === "deno") {
@@ -91862,7 +91992,7 @@ async function refreshManagedTsconfig(defaultTs2, mode) {
   }
   const header = MANAGED_NOTICE + TSCONFIG_HASH_PREFIX + currentTsconfigHash() + `
 `;
-  writeFileSync8(path23.join(process24.cwd(), MANAGED_TSCONFIG), header + JSON.stringify(managed, null, 2) + `
+  writeFileSync9(path24.join(process25.cwd(), MANAGED_TSCONFIG), header + JSON.stringify(managed, null, 2) + `
 `);
   info(colors.green(`Refreshed ${MANAGED_TSCONFIG}`));
   await ensureUserReferencesManaged({
@@ -91898,7 +92028,7 @@ async function refreshManagedDenoImportMap(mode) {
   for (const dir of WORKSPACE_IMPORT_DIRS) {
     imports[`/${dir}/`] = `./${dir}/`;
   }
-  writeFileSync8(path23.join(process24.cwd(), MANAGED_IMPORT_MAP), JSON.stringify({ imports }, null, 2) + `
+  writeFileSync9(path24.join(process25.cwd(), MANAGED_IMPORT_MAP), JSON.stringify({ imports }, null, 2) + `
 `);
   info(colors.green(`Refreshed ${MANAGED_IMPORT_MAP}`));
   await ensureUserReferencesManaged({
@@ -91921,15 +92051,15 @@ async function refreshManagedDenoImportMap(mode) {
   });
 }
 async function ensureUserReferencesManaged(opts) {
-  const existing = [opts.file, ...opts.altFiles ?? []].map((f) => path23.join(process24.cwd(), f)).find((p) => existsSync17(p));
+  const existing = [opts.file, ...opts.altFiles ?? []].map((f) => path24.join(process25.cwd(), f)).find((p) => existsSync18(p));
   if (!existing) {
-    const userPath = path23.join(process24.cwd(), opts.file);
-    writeFileSync8(userPath, JSON.stringify(opts.create, null, 2) + `
+    const userPath = path24.join(process25.cwd(), opts.file);
+    writeFileSync9(userPath, JSON.stringify(opts.create, null, 2) + `
 `);
     info(colors.green(`Created ${opts.file} (references ${opts.token})`));
     return;
   }
-  const existingName = path23.basename(existing);
+  const existingName = path24.basename(existing);
   let text = "";
   try {
     text = readFileSync5(existing, "utf-8");
@@ -91948,7 +92078,7 @@ async function ensureUserReferencesManaged(opts) {
     return;
   }
   if (opts.legacyFormats?.some((fmt) => deepEqual2(parsed, fmt))) {
-    writeFileSync8(existing, JSON.stringify(opts.create, null, 2) + `
+    writeFileSync9(existing, JSON.stringify(opts.create, null, 2) + `
 `);
     info(colors.green(`Migrated previously-generated ${existingName} to reference ${opts.token}`));
     return;
@@ -91967,13 +92097,13 @@ async function ensureUserReferencesManaged(opts) {
     info(colors.gray(`Left ${existingName} unchanged — add ${opts.hint} when ready to enable ` + `workspace /f/, /u/ import resolution (or re-run \`wmill refresh tsconfig\`).`));
     return;
   }
-  writeFileSync8(existing, JSON.stringify(next, null, 2) + `
+  writeFileSync9(existing, JSON.stringify(next, null, 2) + `
 `);
   info(colors.green(`Linked ${existingName} → ${opts.token}`));
 }
 function ensureBunTypesAvailable() {
-  const cwd = process24.cwd();
-  if (existsSync17(path23.join(cwd, "node_modules", "bun-types"))) {
+  const cwd = process25.cwd();
+  if (existsSync18(path24.join(cwd, "node_modules", "bun-types"))) {
     return true;
   }
   try {
@@ -91994,9 +92124,9 @@ function ensureBunTypesAvailable() {
   }
 }
 async function warnIfTsconfigStale(opts) {
-  const cwd = opts?.cwd ?? process24.cwd();
-  const managedPath = path23.join(cwd, MANAGED_TSCONFIG);
-  if (!existsSync17(managedPath))
+  const cwd = opts?.cwd ?? process25.cwd();
+  const managedPath = path24.join(cwd, MANAGED_TSCONFIG);
+  if (!existsSync18(managedPath))
     return;
   let managedText;
   try {
@@ -92014,10 +92144,10 @@ async function warnIfTsconfigStale(opts) {
   }
 }
 function emitTsconfigWarning(message) {
-  process24.stderr.write(`${colors.yellow(message)}
+  process25.stderr.write(`${colors.yellow(message)}
 `);
 }
-var WORKSPACE_IMPORT_DIRS, MANAGED_TSCONFIG = "tsconfig.wmill.json", MANAGED_IMPORT_MAP = "import_map.wmill.json", MANAGED_NOTICE, TSCONFIG_HASH_PREFIX = "// wmill-tsconfig-hash: ", TSCONFIG_HASH_REGEX, LEGACY_GENERATED_TSCONFIGS, command30, tsconfig_default;
+var WORKSPACE_IMPORT_DIRS, MANAGED_TSCONFIG = "tsconfig.wmill.json", MANAGED_IMPORT_MAP = "import_map.wmill.json", MANAGED_NOTICE, TSCONFIG_HASH_PREFIX = "// wmill-tsconfig-hash: ", TSCONFIG_HASH_REGEX, LEGACY_GENERATED_TSCONFIGS, command31, tsconfig_default;
 var init_tsconfig = __esm(async () => {
   init_colors2();
   init_mod3();
@@ -92053,10 +92183,10 @@ var init_tsconfig = __esm(async () => {
       include: ["**/*.ts", "rt.d.ts"]
     }
   ];
-  command30 = new Command().description("Refresh the wmill-managed tsconfig.wmill.json (and Deno import map for Deno projects)").option("--yes", "Non-interactive: wire an existing custom tsconfig.json/deno.json to the managed file without prompting (a previously-generated config is always migrated automatically).").action(async (opts) => {
+  command31 = new Command().description("Refresh the wmill-managed tsconfig.wmill.json (and Deno import map for Deno projects)").option("--yes", "Non-interactive: wire an existing custom tsconfig.json/deno.json to the managed file without prompting (a previously-generated config is always migrated automatically).").action(async (opts) => {
     await refreshTsconfig({ yes: opts.yes === true });
   });
-  tsconfig_default = command30;
+  tsconfig_default = command31;
 });
 
 // src/main.ts
@@ -93333,8 +93463,8 @@ async function pull2(opts) {
     await pushResourceType(workspace.workspaceId, x.name + ".resource-type.json", undefined, x);
   }
 }
-var command22 = new Command().name("hub").description("Hub related commands. EXPERIMENTAL. INTERNAL USE ONLY.").command("pull").description("pull any supported definitions. EXPERIMENTAL.").action(pull2);
-var hub_default = command22;
+var command23 = new Command().name("hub").description("Hub related commands. EXPERIMENTAL. INTERNAL USE ONLY.").command("pull").description("pull any supported definitions. EXPERIMENTAL.").action(pull2);
+var hub_default = command23;
 
 // src/main.ts
 await __promiseAll([
@@ -93435,27 +93565,27 @@ await __promiseAll([
   init_context()
 ]);
 var import_yaml40 = __toESM(require_dist(), 1);
-import { existsSync as existsSync14 } from "node:fs";
+import { existsSync as existsSync15 } from "node:fs";
 import { writeFile as writeFile19 } from "node:fs/promises";
-import { dirname as dirname19, join as join20 } from "node:path";
+import { dirname as dirname19, join as join21 } from "node:path";
 var PROTECTION_RULES_FILENAME = "protection-rules.yaml";
 function getProtectionRulesPath() {
   const wmillPath = getWmillYamlPath();
   if (!wmillPath)
     return null;
-  return join20(dirname19(wmillPath), PROTECTION_RULES_FILENAME);
+  return join21(dirname19(wmillPath), PROTECTION_RULES_FILENAME);
 }
-async function readProtectionRulesFile(path22) {
-  if (!existsSync14(path22))
+async function readProtectionRulesFile(path23) {
+  if (!existsSync15(path23))
     return {};
-  const parsed = await yamlParseFile(path22);
+  const parsed = await yamlParseFile(path23);
   return parsed ?? {};
 }
-async function writeProtectionRulesFile(path22, data3) {
+async function writeProtectionRulesFile(path23, data3) {
   const sorted = {};
   for (const k of Object.keys(data3).sort())
     sorted[k] = data3[k];
-  await writeFile19(path22, import_yaml40.stringify(sorted, yamlOptions), "utf-8");
+  await writeFile19(path23, import_yaml40.stringify(sorted, yamlOptions), "utf-8");
 }
 
 class WorkspaceResolver {
@@ -93500,7 +93630,7 @@ async function configureClientForWorkspace(opts, ws, resolver) {
 // src/commands/protection-rules/utils.ts
 init_colors2();
 init_log();
-import process22 from "node:process";
+import process23 from "node:process";
 function outputResult2(opts, result) {
   if (opts.jsonOutput) {
     console.log(JSON.stringify(result));
@@ -93512,7 +93642,7 @@ function outputResult2(opts, result) {
 }
 function fail(opts, result) {
   outputResult2(opts, { ...result, success: false });
-  process22.exit(1);
+  process23.exit(1);
 }
 function describeEntry(entry) {
   const n = ProtectionRulesConverter.normalizeEntry(entry);
@@ -93656,8 +93786,8 @@ await __promiseAll([
   init_confirm(),
   init_conf()
 ]);
-import process23 from "node:process";
-import { existsSync as existsSync15 } from "node:fs";
+import process24 from "node:process";
+import { existsSync as existsSync16 } from "node:fs";
 async function pushProtectionRules(opts, workspaceArg) {
   if (opts.jsonOutput)
     setSilent(true);
@@ -93667,7 +93797,7 @@ async function pushProtectionRules(opts, workspaceArg) {
       error: "No wmill.yaml found. Run 'wmill init' first — protection-rules.yaml lives next to it."
     });
   }
-  if (!existsSync15(prPath)) {
+  if (!existsSync16(prPath)) {
     fail(opts, {
       error: "No protection-rules.yaml found. Run 'wmill protection-rules pull' first."
     });
@@ -93737,7 +93867,7 @@ async function pushProtectionRules(opts, workspaceArg) {
       workspaces: Object.fromEntries(wsPlans.map((w) => [w.ws, structuredPlan(w.plan)]))
     }));
     if (hadError)
-      process23.exit(1);
+      process24.exit(1);
     return;
   }
   if (!opts.jsonOutput) {
@@ -93751,7 +93881,7 @@ async function pushProtectionRules(opts, workspaceArg) {
         error: "One or more workspaces failed (see errors above); the rest are in sync",
         partialFailure: true
       });
-      process23.exit(1);
+      process24.exit(1);
     }
     if (!opts.dryRun) {
       outputResult2(opts, {
@@ -93763,7 +93893,7 @@ async function pushProtectionRules(opts, workspaceArg) {
   }
   if (opts.dryRun) {
     if (hadError)
-      process23.exit(1);
+      process24.exit(1);
     return;
   }
   for (const w of wsPlans) {
@@ -93772,7 +93902,7 @@ async function pushProtectionRules(opts, workspaceArg) {
     }
   }
   const totalDeletes = changed.reduce((n, w) => n + w.plan.toDelete.length, 0);
-  if (!opts.yes && !!process23.stdin.isTTY) {
+  if (!opts.yes && !!process24.stdin.isTTY) {
     const confirmed = await Confirm.prompt({
       message: totalDeletes > 0 ? `Apply these changes? This DELETES ${totalDeletes} protection rule(s) across ${changed.length} workspace(s).` : `Apply these changes to ${changed.length} workspace(s)?`,
       default: totalDeletes === 0
@@ -93834,7 +93964,7 @@ async function pushProtectionRules(opts, workspaceArg) {
       partialFailure: true,
       ...applied
     });
-    process23.exit(1);
+    process24.exit(1);
   }
   outputResult2(opts, {
     success: true,
@@ -93844,8 +93974,8 @@ async function pushProtectionRules(opts, workspaceArg) {
 }
 
 // src/commands/protection-rules/protection-rules.ts
-var command24 = new Command().description("Sync workspace protection rules between protection-rules.yaml and Windmill. The file is keyed by workspace name; keys must match wmill.yaml 'workspaces'.").command("pull").description("Pull protection rules from Windmill into protection-rules.yaml for a workspace").arguments("[workspace:string]").option("--all", "Pull every workspace defined in wmill.yaml").option("--dry-run", "Show what would change without writing the file").option("--json-output", "Output in JSON format").action(pullProtectionRules).command("push").description("Push protection rules from protection-rules.yaml to Windmill for a workspace (full reconcile: creates, updates, and deletes)").arguments("[workspace:string]").option("--all", "Push every workspace defined in protection-rules.yaml").option("--dry-run", "Show what would change without applying").option("--json-output", "Output in JSON format").option("--yes", "Skip the confirmation prompt (including deletions)").action(pushProtectionRules);
-var protection_rules_default = command24;
+var command25 = new Command().description("Sync workspace protection rules between protection-rules.yaml and Windmill. The file is keyed by workspace name; keys must match wmill.yaml 'workspaces'.").command("pull").description("Pull protection rules from Windmill into protection-rules.yaml for a workspace").arguments("[workspace:string]").option("--all", "Pull every workspace defined in wmill.yaml").option("--dry-run", "Show what would change without writing the file").option("--json-output", "Output in JSON format").action(pullProtectionRules).command("push").description("Push protection rules from protection-rules.yaml to Windmill for a workspace (full reconcile: creates, updates, and deletes)").arguments("[workspace:string]").option("--all", "Push every workspace defined in protection-rules.yaml").option("--dry-run", "Show what would change without applying").option("--json-output", "Output in JSON format").option("--yes", "Skip the confirmation prompt (including deletions)").action(pushProtectionRules);
+var protection_rules_default = command25;
 
 // src/main.ts
 await init_instance();
@@ -93929,8 +94059,8 @@ async function pushWorkerGroups(opts) {
     await pushInstanceConfigs(opts, false);
   }
 }
-var command25 = new Command().description("display worker groups, pull and push worker groups configs").action(displayWorkerGroups).command("pull").description("Pull worker groups (similar to `wmill instance pull --skip-users --skip-settings --skip-groups`)").option("--instance", "Name of the instance to push to, override the active instance").option("--base-url", "Base url to be passed to the instance settings instead of the local one").option("--yes", "Pull without needing confirmation").action(pullWorkerGroups).command("push").description("Push worker groups (similar to `wmill instance push --skip-users --skip-settings --skip-groups`)").option("--instance [instance]", "Name of the instance to push to, override the active instance").option("--base-url [baseUrl]", "If used with --token, will be used as the base url for the instance").option("--yes", "Push without needing confirmation").action(pushWorkerGroups);
-var worker_groups_default = command25;
+var command26 = new Command().description("display worker groups, pull and push worker groups configs").action(displayWorkerGroups).command("pull").description("Pull worker groups (similar to `wmill instance pull --skip-users --skip-settings --skip-groups`)").option("--instance", "Name of the instance to push to, override the active instance").option("--base-url", "Base url to be passed to the instance settings instead of the local one").option("--yes", "Pull without needing confirmation").action(pullWorkerGroups).command("push").description("Push worker groups (similar to `wmill instance push --skip-users --skip-settings --skip-groups`)").option("--instance [instance]", "Name of the instance to push to, override the active instance").option("--base-url [baseUrl]", "If used with --token, will be used as the base url for the instance").option("--yes", "Push without needing confirmation").action(pushWorkerGroups);
+var worker_groups_default = command26;
 
 // src/main.ts
 await init_lint();
@@ -93965,8 +94095,8 @@ import * as http3 from "node:http";
 import * as https from "node:https";
 import { access, readdir as readdir10, realpath, stat as stat17, unlink, writeFile as writeFile20 } from "node:fs/promises";
 import { watch as watch2 } from "node:fs";
-import * as path22 from "node:path";
-import * as fs16 from "node:fs";
+import * as path23 from "node:path";
+import * as fs17 from "node:fs";
 
 // src/commands/dev/pathscript-restore.ts
 var TAG_KEY = "_originalPathScript";
@@ -94061,7 +94191,7 @@ var PORT = 3001;
 var FLOW_SUFFIXES = [".flow", "__flow"];
 var APP_SUFFIXES = [".app", "__app", ".raw_app", "__raw_app"];
 var INLINE_SCRIPT_EXTS = new Set([
-  ...exts.map((e) => path22.extname("x" + e)).filter((e) => e !== ".yml"),
+  ...exts.map((e) => path23.extname("x" + e)).filter((e) => e !== ".yml"),
   ".js"
 ]);
 function stripFolderSuffix(rel, suffixes) {
@@ -94102,13 +94232,13 @@ async function listWorkspacePaths() {
       if (entry.name.startsWith(".") || entry.name === "node_modules")
         continue;
       const childRel = rel ? `${rel}/${entry.name}` : entry.name;
-      const childAbs = path22.join(dir, entry.name);
+      const childAbs = path23.join(dir, entry.name);
       if (entry.isDirectory()) {
         if (isFlowFolderName(entry.name)) {
           items.push({
             path: stripFolderSuffix(childRel, FLOW_SUFFIXES),
             kind: "flow",
-            _metaPath: path22.join(childAbs, "flow.yaml")
+            _metaPath: path23.join(childAbs, "flow.yaml")
           });
           continue;
         }
@@ -94156,25 +94286,25 @@ async function listWorkspacePaths() {
 async function dev2(opts) {
   if (!opts.path) {
     const cwd = process.cwd();
-    const cwdBasename = path22.basename(cwd);
+    const cwdBasename = path23.basename(cwd);
     await loadNonDottedPathsSetting();
     if (isFlowFolderName(cwdBasename)) {
       GLOBAL_CONFIG_OPT.noCdToRoot = true;
       let searchDir = cwd;
       let workspaceRoot;
       while (true) {
-        const wmillYaml = path22.join(searchDir, "wmill.yaml");
-        if (fs16.existsSync(wmillYaml)) {
+        const wmillYaml = path23.join(searchDir, "wmill.yaml");
+        if (fs17.existsSync(wmillYaml)) {
           workspaceRoot = searchDir;
           break;
         }
-        const parentDir = path22.dirname(searchDir);
+        const parentDir = path23.dirname(searchDir);
         if (parentDir === searchDir)
           break;
         searchDir = parentDir;
       }
       if (workspaceRoot) {
-        const relPath = path22.relative(workspaceRoot, cwd).replaceAll("\\", "/");
+        const relPath = path23.relative(workspaceRoot, cwd).replaceAll("\\", "/");
         opts.path = stripFolderSuffix(relPath, FLOW_SUFFIXES);
         info(`Detected flow folder, path: ${opts.path}`);
         process.chdir(workspaceRoot);
@@ -94267,7 +94397,7 @@ async function dev2(opts) {
           return;
         const wmFlowPath = stripFolderSuffix(localPath.replace(/\/$/, ""), FLOW_SUFFIXES);
         const localFlow = await yamlParseFile(localPath + "flow.yaml");
-        await replaceInlineScripts(localFlow.value.modules, async (path23) => await readTextFile(localPath + path23), exports_log, localPath, SEP21, undefined);
+        await replaceInlineScripts(localFlow.value.modules, async (path24) => await readTextFile(localPath + path24), exports_log, localPath, SEP21, undefined);
         snapshotPathScripts(localFlow.value);
         const localScriptReader = createPreviewLocalScriptReader({
           exts,
@@ -94437,7 +94567,7 @@ async function dev2(opts) {
       for (const file of dirFiles) {
         if (file === "flow.yaml" || file === "flow.json" || file.startsWith("."))
           continue;
-        if (!INLINE_SCRIPT_EXTS.has(path22.extname(file)))
+        if (!INLINE_SCRIPT_EXTS.has(path23.extname(file)))
           continue;
         if (!extractedPaths.has(file)) {
           await unlink(flowDir + file);
@@ -94629,7 +94759,7 @@ async function dev2(opts) {
       }
       socket.destroy();
     });
-    return new Promise((resolve10) => {
+    return new Promise((resolve11) => {
       proxyServer.listen(proxyPort, BIND_HOST, () => {
         console.log(`Dev proxy listening on http://localhost:${proxyPort}`);
         if (opts.path) {
@@ -94639,7 +94769,7 @@ async function dev2(opts) {
           console.log("(pass --path <path> to skip the picker)");
         }
         maybeOpenBrowser(`http://localhost:${proxyPort}/`);
-        resolve10();
+        resolve11();
       });
     });
   }
@@ -94675,8 +94805,8 @@ async function dev2(opts) {
   await Promise.all([startServer(), watchChanges()]);
   console.log("Stopped dev mode");
 }
-var command26 = new Command().description("Watch local file changes and live-reload the dev page for preview. Does NOT deploy to the remote workspace — use wmill sync push for that.").option("--includes <pattern...:string>", "Filter paths given a glob pattern or path").option("--proxy-port <port:number>", "Port for a localhost reverse proxy to the remote Windmill server").option("--path <path:string>", "Watch a specific windmill path (e.g., u/admin/my_script or f/my_flow)").option("--no-open", "Do not open the browser automatically").action(dev2);
-var dev_default2 = command26;
+var command27 = new Command().description("Watch local file changes and live-reload the dev page for preview. Does NOT deploy to the remote workspace — use wmill sync push for that.").option("--includes <pattern...:string>", "Filter paths given a glob pattern or path").option("--proxy-port <port:number>", "Port for a localhost reverse proxy to the remote Windmill server").option("--path <path:string>", "Watch a specific windmill path (e.g., u/admin/my_script or f/my_flow)").option("--no-open", "Do not open the browser automatically").action(dev2);
+var dev_default2 = command27;
 
 // src/main.ts
 init_gen();
@@ -94745,9 +94875,9 @@ class NpmProvider extends Provider {
       if (verbose)
         process.stderr.write(d);
     });
-    const exitCode = await new Promise((resolve10, reject) => {
+    const exitCode = await new Promise((resolve11, reject) => {
       proc.on("error", reject);
-      proc.on("close", resolve10);
+      proc.on("close", resolve11);
     }).catch((e) => {
       throw new Error(`failed to run npm: ${e instanceof Error ? e.message : e}
 
@@ -94833,8 +94963,8 @@ Worker Group: ${group.groupName} (${group.workers.length} workers)`);
     info("Use 'wmill instance add' to add a new instance");
   }
 }
-var command27 = new Command().description("List all workers grouped by worker groups").option("--instance [instance]", "Name of the instance to push to, override the active instance").option("--base-url [baseUrl]", "If used with --token, will be used as the base url for the instance").action(displayWorkers);
-var workers_default = command27;
+var command28 = new Command().description("List all workers grouped by worker groups").option("--instance [instance]", "Name of the instance to push to, override the active instance").option("--base-url [baseUrl]", "If used with --token, will be used as the base url for the instance").action(displayWorkers);
+var workers_default = command28;
 
 // src/commands/queues/queues.ts
 init_mod3();
@@ -94942,8 +95072,8 @@ async function displayQueues(opts, workspace) {
     info("Use 'wmill instance add' to add a new instance");
   }
 }
-var command28 = new Command().description("List all queues with their metrics").arguments("[workspace:string] the optional workspace to filter by (default to all workspaces)").option("--instance [instance]", "Name of the instance to push to, override the active instance").option("--base-url [baseUrl]", "If used with --token, will be used as the base url for the instance").action(displayQueues);
-var queues_default = command28;
+var command29 = new Command().description("List all queues with their metrics").arguments("[workspace:string] the optional workspace to filter by (default to all workspaces)").option("--instance [instance]", "Name of the instance to push to, override the active instance").option("--base-url [baseUrl]", "If used with --token, will be used as the base url for the instance").action(displayQueues);
+var queues_default = command29;
 
 // src/main.ts
 await init_dependencies();
@@ -95443,7 +95573,7 @@ await __promiseAll([
   init_freshness()
 ]);
 import { cp, mkdir as mkdir13, readdir as readdir11, rm as rm6, stat as stat19, writeFile as writeFile21 } from "node:fs/promises";
-import { join as join22 } from "node:path";
+import { join as join23 } from "node:path";
 var WMILL_INIT_AI_SKILLS_SOURCE_ENV = "WMILL_INIT_AI_SKILLS_SOURCE";
 var WMILL_INIT_AI_AGENTS_SOURCE_ENV = "WMILL_INIT_AI_AGENTS_SOURCE";
 var WMILL_INIT_AI_CLAUDE_SOURCE_ENV = "WMILL_INIT_AI_CLAUDE_SOURCE";
@@ -95456,20 +95586,20 @@ async function writeAiGuidanceFiles(options) {
   const skillMetadata = options.skillsSourcePath ? await readSkillMetadataFromDirectory(options.skillsSourcePath) : getGeneratedSkillMetadata();
   const rawAgentsCliContent = options.agentsSourcePath != null ? await readTextFile(options.agentsSourcePath) : generateAgentsCliMdContent(buildSkillsReference(skillMetadata));
   const agentsCliContent = injectPromptsHashMarker(rawAgentsCliContent, currentPromptsHash(nonDottedPaths));
-  const agentsCliPath = join22(options.targetDir, AGENTS_WMILL_FILENAME);
+  const agentsCliPath = join23(options.targetDir, AGENTS_WMILL_FILENAME);
   await writeFile21(agentsCliPath, agentsCliContent, "utf8");
   const agentsCliWritten = true;
   const legacyManagedRemoved = await migrateLegacyManagedFile(options.targetDir);
   const resolveMigration = cacheOnce(options.resolveAgentsMdMigration);
   const agentsMdResult = await reconcileIncludingFile({
-    path: join22(options.targetDir, "AGENTS.md"),
+    path: join23(options.targetDir, "AGENTS.md"),
     includeLine: AGENTS_WMILL_INCLUDE_LINE,
     skeleton: generateAgentsMdSkeleton(),
     resolveMigration
   });
   const claudeSkeleton = options.claudeSourcePath != null ? await readTextFile(options.claudeSourcePath) : CLAUDE_MD_DEFAULT;
   const claudeMdResult = await reconcileIncludingFile({
-    path: join22(options.targetDir, "CLAUDE.md"),
+    path: join23(options.targetDir, "CLAUDE.md"),
     includeLine: CLAUDE_MD_INCLUDE_LINE,
     skeleton: claudeSkeleton,
     resolveMigration
@@ -95491,7 +95621,7 @@ async function writeAiGuidanceFiles(options) {
 }
 async function migrateLegacyManagedFile(targetDir) {
   for (const fileName of ["AGENTS.md", "CLAUDE.md"]) {
-    const filePath = join22(targetDir, fileName);
+    const filePath = join23(targetDir, fileName);
     const existing = await readTextFile(filePath).catch(() => null);
     if (existing == null)
       continue;
@@ -95500,7 +95630,7 @@ async function migrateLegacyManagedFile(targetDir) {
       await writeFile21(filePath, rewritten, "utf8");
     }
   }
-  const legacyPath = join22(targetDir, LEGACY_AGENTS_CLI_FILENAME);
+  const legacyPath = join23(targetDir, LEGACY_AGENTS_CLI_FILENAME);
   const legacyExists = await stat19(legacyPath).catch(() => null) != null;
   if (legacyExists) {
     await rm6(legacyPath, { force: true });
@@ -95577,9 +95707,9 @@ async function copySkillsFromSource(targetDir, skillsSourcePath) {
 async function writeGeneratedSkills(targetDir, nonDottedPaths) {
   const skillsDirs = await ensureSkillsDirectories(targetDir);
   await Promise.all(skillsDirs.flatMap((skillsDir) => SKILLS.map(async (skill) => {
-    const skillDir = join22(skillsDir, skill.name);
+    const skillDir = join23(skillsDir, skill.name);
     await mkdir13(skillDir, { recursive: true });
-    await writeFile21(join22(skillDir, "SKILL.md"), renderGeneratedSkillContent(skill.name, nonDottedPaths), "utf8");
+    await writeFile21(join23(skillDir, "SKILL.md"), renderGeneratedSkillContent(skill.name, nonDottedPaths), "utf8");
   })));
   return SKILLS.map((skill) => ({
     ...skill,
@@ -95593,14 +95723,14 @@ function getGeneratedSkillMetadata() {
   }));
 }
 async function ensureSkillsDirectories(targetDir) {
-  const skillsDirs = SKILL_TARGET_ROOTS.map((root) => join22(targetDir, root, "skills"));
+  const skillsDirs = SKILL_TARGET_ROOTS.map((root) => join23(targetDir, root, "skills"));
   await Promise.all(skillsDirs.map((skillsDir) => mkdir13(skillsDir, { recursive: true })));
   return skillsDirs;
 }
 async function copyDirectoryContents(sourceDir, targetDir) {
   const entries = await readdir11(sourceDir, { withFileTypes: true });
   await Promise.all(entries.map(async (entry) => {
-    await cp(join22(sourceDir, entry.name), join22(targetDir, entry.name), {
+    await cp(join23(sourceDir, entry.name), join23(targetDir, entry.name), {
       recursive: true,
       force: true
     });
@@ -95643,7 +95773,7 @@ async function readSkillMetadataFromDirectory(skillsDir) {
     if (!entry.isDirectory()) {
       continue;
     }
-    const skillPath = join22(skillsDir, entry.name, "SKILL.md");
+    const skillPath = join23(skillsDir, entry.name, "SKILL.md");
     if (!await stat19(skillPath).catch(() => null)) {
       continue;
     }
@@ -95789,8 +95919,8 @@ async function promptMigration() {
 async function promptsAction(opts) {
   await refreshPrompts({ yes: opts.yes === true });
 }
-var command29 = new Command().description("Refresh AGENTS.wmill.md and managed skills. User-owned AGENTS.md and CLAUDE.md are never overwritten unless you opt in.").option("--yes", "Non-interactive: append the @AGENTS.wmill.md include to an existing AGENTS.md / CLAUDE.md without prompting. Without it, a non-interactive run leaves an unlinked file untouched.").action(promptsAction);
-var prompts_default = command29;
+var command30 = new Command().description("Refresh AGENTS.wmill.md and managed skills. User-owned AGENTS.md and CLAUDE.md are never overwritten unless you opt in.").option("--yes", "Non-interactive: append the @AGENTS.wmill.md include to an existing AGENTS.md / CLAUDE.md without prompting. Without it, a non-interactive run leaves an unlinked file untouched.").action(promptsAction);
+var prompts_default = command30;
 
 // src/commands/init/init.ts
 await init_tsconfig();
@@ -95984,14 +96114,14 @@ async function initAction(opts) {
     }
   }
 }
-var command31 = new Command().description("Bootstrap a windmill project with a wmill.yaml file").option("--use-default", "Use default settings without checking backend").option("--use-backend", "Use backend git-sync settings if available").option("--repository <repo:string>", "Specify repository path (e.g., u/user/repo) when using backend settings").option("--bind-profile", "Automatically bind active workspace profile to current Git branch").option("--no-bind-profile", "Skip workspace profile binding prompt").action(initAction);
-var init_default = command31;
+var command32 = new Command().description("Bootstrap a windmill project with a wmill.yaml file").option("--use-default", "Use default settings without checking backend").option("--use-backend", "Use backend git-sync settings if available").option("--repository <repo:string>", "Specify repository path (e.g., u/user/repo) when using backend settings").option("--bind-profile", "Automatically bind active workspace profile to current Git branch").option("--no-bind-profile", "Skip workspace profile binding prompt").action(initAction);
+var init_default = command32;
 
 // src/commands/refresh/refresh.ts
 init_mod3();
 await init_tsconfig();
-var command32 = new Command().description("Refresh wmill-managed project files (AGENTS.wmill.md, skills, tsconfig.wmill.json)").command("prompts", prompts_default).command("tsconfig", tsconfig_default);
-var refresh_default = command32;
+var command33 = new Command().description("Refresh wmill-managed project files (AGENTS.wmill.md, skills, tsconfig.wmill.json)").command("prompts", prompts_default).command("tsconfig", tsconfig_default);
+var refresh_default = command33;
 
 // src/main.ts
 init_freshness_gate();
@@ -96008,7 +96138,7 @@ await __promiseAll([
   init_conf(),
   init_utils()
 ]);
-import * as fs17 from "node:fs/promises";
+import * as fs18 from "node:fs/promises";
 async function pullJobs(opts, workspace) {
   opts = await mergeConfigWithConfigFile(opts);
   const ws = await resolveWorkspace({ ...opts, workspace });
@@ -96052,7 +96182,7 @@ Warning: Found ${workers.length} active worker(s) on the instance.`));
     page++;
   }
   const completedPath = opts.completedOutput || "completed_jobs.json";
-  await fs17.writeFile(completedPath, JSON.stringify(completedJobs, null, 2));
+  await fs18.writeFile(completedPath, JSON.stringify(completedJobs, null, 2));
   info(colors.green(`Successfully pulled ${completedJobs.length} completed jobs to ${completedPath}`));
   let queuedJobs = [];
   page = 1;
@@ -96070,7 +96200,7 @@ Warning: Found ${workers.length} active worker(s) on the instance.`));
     page++;
   }
   const queuedPath = opts.queuedOutput || "queued_jobs.json";
-  await fs17.writeFile(queuedPath, JSON.stringify(queuedJobs, null, 2));
+  await fs18.writeFile(queuedPath, JSON.stringify(queuedJobs, null, 2));
   info(colors.green(`Successfully pulled ${queuedJobs.length} queued jobs to ${queuedPath}`));
   const allJobs = [...queuedJobs, ...completedJobs];
   if (allJobs.length > 0) {
@@ -96160,8 +96290,8 @@ Warning: Found ${workers.length} active worker(s) on the instance.`));
 }
 var pull3 = new Command().description("Pull completed and queued jobs from workspace").option("-c, --completed-output <file:string>", "Completed jobs output file (default: completed_jobs.json)").option("-q, --queued-output <file:string>", "Queued jobs output file (default: queued_jobs.json)").option("--skip-worker-check", "Skip checking for active workers before export").arguments("[workspace:string]").action(pullJobs);
 var push12 = new Command().description("Push completed and queued jobs to workspace").option("-c, --completed-file <file:string>", "Completed jobs input file (default: completed_jobs.json)").option("-q, --queued-file <file:string>", "Queued jobs input file (default: queued_jobs.json)").option("--skip-worker-check", "Skip checking for active workers before import").arguments("[workspace:string]").action(pushJobs);
-var command33 = new Command().description("Manage jobs (import/export)").command("pull", pull3).command("push", push12);
-var jobs_default = command33;
+var command34 = new Command().description("Manage jobs (import/export)").command("pull", pull3).command("push", push12);
+var jobs_default = command34;
 
 // src/commands/job/job.ts
 init_mod3();
@@ -96522,8 +96652,8 @@ async function restart(opts, id) {
   console.log(newId);
 }
 var listOptions = (cmd) => cmd.option("--json", "Output as JSON (for piping to jq)").option("--script-path <scriptPath:string>", "Filter by exact script/flow path").option("--created-by <createdBy:string>", "Filter by creator username").option("--running", "Show only running jobs").option("--failed", "Show only failed jobs").option("--success <success:boolean>", "Filter by success status (true/false)").option("--limit <limit:number>", "Number of jobs to return (default 30, max 100)").option("--job-kinds <jobKinds:string>", "Filter by job kinds (default: script,flow,singlestepflow)").option("--label <label:string>", "Filter by job label").option("--all", "Include sub-jobs (flow steps). By default only top-level jobs are shown").option("--parent <parent:string>", "Filter by parent job ID (show sub-jobs of a specific flow)").option("--is-flow-step", "Show only flow step jobs");
-var command34 = listOptions(new Command().description("Manage jobs (list, inspect, cancel)")).action(list13).command("list", listOptions(new Command().description("List recent jobs"))).action(list13).command("get", "Get job details. For flows: shows step tree with sub-job IDs").arguments("<id:string>").option("--json", "Output as JSON (for piping to jq)").action(get10).command("result", "Get the result of a completed job (machine-friendly)").arguments("<id:string>").action(result).command("logs", "Get job logs. For flows: aggregates all step logs").arguments("<id:string>").action(logs).command("cancel", "Cancel a running or queued job").arguments("<id:string>").option("--reason <reason:string>", "Reason for cancellation").action(cancel).command("rerun", "Re-run a completed job with the same args. Prints the new job UUID on stdout.").arguments("<id:string>").action(rerun).command("restart", "Restart a completed flow at a given top-level step. Prints the new flow job UUID on stdout.").arguments("<id:string>").option("--step <stepId:string>", "Top-level step id to restart the flow from", { required: true }).option("--iteration <n:number>", "For a top-level branchall or for-loop step, the iteration to restart at").action(restart);
-var job_default = command34;
+var command35 = listOptions(new Command().description("Manage jobs (list, inspect, cancel)")).action(list13).command("list", listOptions(new Command().description("List recent jobs"))).action(list13).command("get", "Get job details. For flows: shows step tree with sub-job IDs").arguments("<id:string>").option("--json", "Output as JSON (for piping to jq)").action(get10).command("result", "Get the result of a completed job (machine-friendly)").arguments("<id:string>").action(result).command("logs", "Get job logs. For flows: aggregates all step logs").arguments("<id:string>").action(logs).command("cancel", "Cancel a running or queued job").arguments("<id:string>").option("--reason <reason:string>", "Reason for cancellation").action(cancel).command("rerun", "Re-run a completed job with the same args. Prints the new job UUID on stdout.").arguments("<id:string>").action(rerun).command("restart", "Restart a completed flow at a given top-level step. Prints the new flow job UUID on stdout.").arguments("<id:string>").option("--step <stepId:string>", "Top-level step id to restart the flow from", { required: true }).option("--iteration <n:number>", "For a top-level branchall or for-loop step, the iteration to restart at").action(restart);
+var job_default = command35;
 
 // src/commands/group/group.ts
 init_mod3();
@@ -96622,8 +96752,8 @@ async function removeUser(opts, name, username) {
   });
   info(colors.green(`User '${username}' removed from group '${name}'.`));
 }
-var command35 = new Command().description("Manage workspace groups").option("--json", "Output as JSON (for piping to jq)").action(list14).command("list", "List all groups in the workspace").option("--json", "Output as JSON (for piping to jq)").action(list14).command("get", "Get group details and members").arguments("<name:string>").option("--json", "Output as JSON (for piping to jq)").action(get11).command("create", "Create a new group").arguments("<name:string>").option("--summary <summary:string>", "Group summary/description").action(create).command("delete", "Delete a group").arguments("<name:string>").action(deleteGroup2).command("add-user", "Add a user to a group").arguments("<name:string> <username:string>").action(addUser2).command("remove-user", "Remove a user from a group").arguments("<name:string> <username:string>").action(removeUser);
-var group_default = command35;
+var command36 = new Command().description("Manage workspace groups").option("--json", "Output as JSON (for piping to jq)").action(list14).command("list", "List all groups in the workspace").option("--json", "Output as JSON (for piping to jq)").action(list14).command("get", "Get group details and members").arguments("<name:string>").option("--json", "Output as JSON (for piping to jq)").action(get11).command("create", "Create a new group").arguments("<name:string>").option("--summary <summary:string>", "Group summary/description").action(create).command("delete", "Delete a group").arguments("<name:string>").action(deleteGroup2).command("add-user", "Add a user to a group").arguments("<name:string> <username:string>").action(addUser2).command("remove-user", "Remove a user from a group").arguments("<name:string> <username:string>").action(removeUser);
+var group_default = command36;
 
 // src/commands/audit/audit.ts
 init_mod3();
@@ -96700,8 +96830,8 @@ async function get12(opts, id) {
   }
 }
 var auditListOptions = (cmd) => cmd.option("--json", "Output as JSON (for piping to jq)").option("--username <username:string>", "Filter by username").option("--operation <operation:string>", "Filter by operation (exact or prefix)").option("--action-kind <actionKind:string>", "Filter by action kind (Create, Update, Delete, Execute)").option("--before <before:string>", "Filter events before this timestamp").option("--after <after:string>", "Filter events after this timestamp").option("--limit <limit:number>", "Number of entries to return (default 30, max 100)");
-var command36 = auditListOptions(new Command().description("View audit logs (requires admin)")).action(list15).command("list", auditListOptions(new Command().description("List audit log entries"))).action(list15).command("get", "Get a specific audit log entry").arguments("<id:string>").option("--json", "Output as JSON (for piping to jq)").action(get12);
-var audit_default = command36;
+var command37 = auditListOptions(new Command().description("View audit logs (requires admin)")).action(list15).command("list", auditListOptions(new Command().description("List audit log entries"))).action(list15).command("get", "Get a specific audit log entry").arguments("<id:string>").option("--json", "Output as JSON (for piping to jq)").action(get12);
+var audit_default = command37;
 
 // src/commands/token/token.ts
 init_mod3();
@@ -96755,8 +96885,8 @@ async function deleteToken2(opts, tokenPrefix) {
   await deleteToken({ tokenPrefix });
   info(colors.green(`Token with prefix '${tokenPrefix}' deleted.`));
 }
-var command37 = new Command().description("Manage API tokens").option("--json", "Output as JSON (for piping to jq)").action(list16).command("list", "List API tokens").option("--json", "Output as JSON (for piping to jq)").action(list16).command("create", "Create a new API token").option("--label <label:string>", "Token label").option("--expiration <expiration:string>", "Token expiration (ISO 8601 timestamp)").action(create2).command("delete", "Delete a token by its prefix").arguments("<token_prefix:string>").action(deleteToken2);
-var token_default = command37;
+var command38 = new Command().description("Manage API tokens").option("--json", "Output as JSON (for piping to jq)").action(list16).command("list", "List API tokens").option("--json", "Output as JSON (for piping to jq)").action(list16).command("create", "Create a new API token").option("--label <label:string>", "Token label").option("--expiration <expiration:string>", "Token expiration (ISO 8601 timestamp)").action(create2).command("delete", "Delete a token by its prefix").arguments("<token_prefix:string>").action(deleteToken2);
+var token_default = command38;
 
 // src/main.ts
 await init_generate_metadata();
@@ -96817,8 +96947,8 @@ ${await res.text()}`);
     console.log();
   }
 }
-var command38 = new Command().name("docs").description("Search Windmill documentation.").arguments("<query:string>").option("--json", "Output results as JSON.").action(docs);
-var docs_default = command38;
+var command39 = new Command().name("docs").description("Search Windmill documentation.").arguments("<query:string>").option("--json", "Output results as JSON.").action(docs);
+var docs_default = command39;
 
 // src/commands/config/config.ts
 init_mod3();
@@ -96888,8 +97018,8 @@ async function migrateAction() {
     info(`   Also removed additional legacy keys: ${legacyKeys.slice(1).join(", ")}`);
   }
 }
-var command39 = new Command().name("config").description("Show all available wmill.yaml configuration options").option("--json", "Output as JSON for programmatic consumption").action(configAction).command("migrate").description("Migrate wmill.yaml from gitBranches/environments to workspaces format").action(migrateAction);
-var config_default = command39;
+var command40 = new Command().name("config").description("Show all available wmill.yaml configuration options").option("--json", "Output as JSON for programmatic consumption").action(configAction).command("migrate").description("Migrate wmill.yaml from gitBranches/environments to workspaces format").action(migrateAction);
+var config_default = command40;
 
 // src/commands/datatable/datatable.ts
 init_mod3();
@@ -98235,16 +98365,16 @@ async function startServe(opts) {
     error(`server error: ${err.message}`);
     process.exitCode = 1;
   });
-  await new Promise((resolve10) => server.listen(port, host, () => resolve10()));
+  await new Promise((resolve11) => server.listen(port, host, () => resolve11()));
   return {
     host,
     port,
     user: DEFAULT_USER,
     password,
     connectionString: (datatableName) => `postgresql://${DEFAULT_USER}:${encodeURIComponent(password)}@${host}:${port}/${encodeURIComponent(datatableName)}`,
-    close: () => new Promise((resolve10) => {
-      server.close(() => resolve10());
-      setTimeout(resolve10, 1000).unref();
+    close: () => new Promise((resolve11) => {
+      server.close(() => resolve11());
+      setTimeout(resolve11, 1000).unref();
     })
   };
 }
@@ -98753,13 +98883,13 @@ async function psql(opts) {
     }
     handle.close().finally(() => process.exit(1));
   });
-  const exitCode = await new Promise((resolve10) => {
+  const exitCode = await new Promise((resolve11) => {
     child.on("exit", (code2, signal) => {
       if (signal && typeof signal === "string") {
         const num = signalToNumber(signal);
-        resolve10(num !== undefined ? 128 + num : 1);
+        resolve11(num !== undefined ? 128 + num : 1);
       } else {
-        resolve10(code2 ?? 0);
+        resolve11(code2 ?? 0);
       }
     });
   });
@@ -98857,8 +98987,8 @@ async function serve2(opts) {
 async function psql2(opts) {
   await psql(opts);
 }
-var command40 = new Command().description("datatable related commands").command("list", "list all datatables in the workspace").option("--json", "Output as JSON (for piping to jq)").action(list17).command("run", "run a SQL query on a datatable").arguments("<sql:string>").option("-n --name <name:string>", "Datatable name (default: main)").option("-s --silent", "Output only the final result as JSON. Useful for scripting.").action(run4).command("migrate", migrateCommand).command("create", "register a datatable database in the workspace (default: instance-backed 'main') so scripts can use datatable://<name>").arguments("[name:string]").option("--resource <resource:string>", "Back the datatable with an existing postgresql resource path instead of the instance database").option("--force", "Allow adding to a workspace that already has datatables (fork metadata on existing ones is not preserved)").action(create3).command("serve", "Serve all datatables as a Postgres-wire endpoint (psql, DBeaver, pgAdmin); the client picks the datatable via the database name in its connection string").option("--port <port:number>", "Port to listen on (default: first free port in 5433-5500)").option("--host <host:string>", "Bind address (default: 127.0.0.1)").option("--password <password:string>", "Password for Postgres clients (default: generate a random password at startup)").action(serve2).command("psql", "Start a serve listener and launch psql connected to it").option("-n --name <name:string>", "Datatable to connect psql to (default: main)").option("--port <port:number>", "Port the proxy listens on (default: first free port in 5433-5500)").option("--host <host:string>", "Bind address for the proxy (default: 127.0.0.1)").option("--password <password:string>", "Password for the temporary Postgres proxy (default: generate a random password at startup)").action(psql2);
-var datatable_default = command40;
+var command41 = new Command().description("datatable related commands").command("list", "list all datatables in the workspace").option("--json", "Output as JSON (for piping to jq)").action(list17).command("run", "run a SQL query on a datatable").arguments("<sql:string>").option("-n --name <name:string>", "Datatable name (default: main)").option("-s --silent", "Output only the final result as JSON. Useful for scripting.").action(run4).command("migrate", migrateCommand).command("create", "register a datatable database in the workspace (default: instance-backed 'main') so scripts can use datatable://<name>").arguments("[name:string]").option("--resource <resource:string>", "Back the datatable with an existing postgresql resource path instead of the instance database").option("--force", "Allow adding to a workspace that already has datatables (fork metadata on existing ones is not preserved)").action(create3).command("serve", "Serve all datatables as a Postgres-wire endpoint (psql, DBeaver, pgAdmin); the client picks the datatable via the database name in its connection string").option("--port <port:number>", "Port to listen on (default: first free port in 5433-5500)").option("--host <host:string>", "Bind address (default: 127.0.0.1)").option("--password <password:string>", "Password for Postgres clients (default: generate a random password at startup)").action(serve2).command("psql", "Start a serve listener and launch psql connected to it").option("-n --name <name:string>", "Datatable to connect psql to (default: main)").option("--port <port:number>", "Port the proxy listens on (default: first free port in 5433-5500)").option("--host <host:string>", "Bind address for the proxy (default: 127.0.0.1)").option("--password <password:string>", "Password for the temporary Postgres proxy (default: generate a random password at startup)").action(psql2);
+var datatable_default = command41;
 
 // src/commands/pipeline/pipeline.ts
 init_mod3();
@@ -98874,10 +99004,10 @@ await __promiseAll([
 
 // src/commands/pipeline/boundedCascade.ts
 var SCRIPT_PREFIX = "script:";
-var scriptNodeId = (path24) => `${SCRIPT_PREFIX}${path24}`;
+var scriptNodeId = (path25) => `${SCRIPT_PREFIX}${path25}`;
 var isScriptNode = (id) => id.startsWith(SCRIPT_PREFIX);
 var scriptPathOf = (id) => id.slice(SCRIPT_PREFIX.length);
-var assetNodeId = (kind, path24) => `${kind}:${path24}`;
+var assetNodeId = (kind, path25) => `${kind}:${path25}`;
 var NON_AUTORUN_TRIGGER_KINDS = new Set([
   "kafka",
   "mqtt",
@@ -99112,9 +99242,9 @@ await __promiseAll([
   init_script_common(),
   init_conf()
 ]);
-import * as fs18 from "node:fs";
-import * as path24 from "node:path";
-import process25 from "node:process";
+import * as fs19 from "node:fs";
+import * as path25 from "node:path";
+import process26 from "node:process";
 
 // src/commands/pipeline/duckdbMacros.ts
 function stripKw(s2, kw) {
@@ -99346,7 +99476,7 @@ function parseMacroAnnotations(content) {
 // src/commands/pipeline/localGraph.ts
 function workspaceRoot() {
   const yaml = getWmillYamlPath();
-  return yaml ? path24.dirname(yaml) : process25.cwd();
+  return yaml ? path25.dirname(yaml) : process26.cwd();
 }
 function wasmFnForLanguage(language) {
   switch (language) {
@@ -99575,14 +99705,14 @@ async function collectScripts(folderDir, root, defaultTs2) {
   function walk(dir) {
     let entries;
     try {
-      entries = fs18.readdirSync(dir, { withFileTypes: true });
+      entries = fs19.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const e2 of entries) {
       if (e2.name.startsWith(".") || e2.name === "node_modules")
         continue;
-      const abs = path24.join(dir, e2.name);
+      const abs = path25.join(dir, e2.name);
       if (e2.isDirectory()) {
         walk(abs);
         continue;
@@ -99592,7 +99722,7 @@ async function collectScripts(folderDir, root, defaultTs2) {
       const ext2 = exts.find((x3) => e2.name.endsWith(x3));
       if (!ext2)
         continue;
-      const relFromRoot = path24.relative(root, abs).replaceAll("\\", "/");
+      const relFromRoot = path25.relative(root, abs).replaceAll("\\", "/");
       let language;
       try {
         language = inferContentTypeFromFilePath(abs, defaultTs2);
@@ -99601,7 +99731,7 @@ async function collectScripts(folderDir, root, defaultTs2) {
       }
       out.push({
         path: removeExtensionToPath(relFromRoot),
-        content: fs18.readFileSync(abs, "utf-8"),
+        content: fs19.readFileSync(abs, "utf-8"),
         language
       });
     }
@@ -99611,11 +99741,11 @@ async function collectScripts(folderDir, root, defaultTs2) {
   return out;
 }
 function hideDbtRunnables(graph) {
-  const key = (usage_kind, path25) => `${usage_kind}:${path25}`;
+  const key = (usage_kind, path26) => `${usage_kind}:${path26}`;
   const dbtKeys = new Set((graph.runnables ?? []).filter((r2) => r2.dbt).map((r2) => key(r2.usage_kind, r2.path)));
   if (dbtKeys.size === 0)
     return graph;
-  const kept = (usage_kind, path25) => !dbtKeys.has(key(usage_kind, path25));
+  const kept = (usage_kind, path26) => !dbtKeys.has(key(usage_kind, path26));
   return {
     ...graph,
     runnables: graph.runnables.filter((r2) => kept(r2.usage_kind, r2.path)),
@@ -99631,7 +99761,7 @@ function hideDbtRunnables(graph) {
 }
 async function buildLocalPipelineGraph(args) {
   const folderClean = args.folder.replace(/^f\//, "").replace(/\/$/, "");
-  const folderDir = path24.join(args.root, "f", folderClean);
+  const folderDir = path25.join(args.root, "f", folderClean);
   const all = await collectScripts(folderDir, args.root, args.defaultTs);
   const libMacros = collectMacroLibraries(args.root);
   const runnables = [];
@@ -99865,14 +99995,14 @@ function collectMacroLibraries(root) {
   const walk = (dir) => {
     let entries;
     try {
-      entries = fs18.readdirSync(dir, { withFileTypes: true });
+      entries = fs19.readdirSync(dir, { withFileTypes: true });
     } catch {
       return;
     }
     for (const e2 of entries) {
       if (e2.name.startsWith(".") || e2.name === "node_modules")
         continue;
-      const abs = path24.join(dir, e2.name);
+      const abs = path25.join(dir, e2.name);
       if (e2.isDirectory()) {
         walk(abs);
         continue;
@@ -99881,17 +100011,17 @@ function collectMacroLibraries(root) {
         continue;
       let content;
       try {
-        content = fs18.readFileSync(abs, "utf-8");
+        content = fs19.readFileSync(abs, "utf-8");
       } catch {
         continue;
       }
       if (!parseMacroAnnotations(content).macros)
         continue;
-      const relFromRoot = path24.relative(root, abs).replaceAll("\\", "/");
+      const relFromRoot = path25.relative(root, abs).replaceAll("\\", "/");
       out.set(removeExtensionToPath(relFromRoot), parseMacroLibrary(content));
     }
   };
-  walk(path24.join(root, "f"));
+  walk(path25.join(root, "f"));
   return out;
 }
 function buildMacroEdges(all, libMacros, runnables) {
@@ -99996,25 +100126,25 @@ await __promiseAll([
   init_codebase()
 ]);
 import * as http4 from "node:http";
-import * as fs19 from "node:fs";
-import * as path25 from "node:path";
+import * as fs20 from "node:fs";
+import * as path26 from "node:path";
 import { createHash as createHash3, randomBytes as randomBytes2 } from "node:crypto";
-import process26 from "node:process";
+import process27 from "node:process";
 var PORT2 = 3201;
 var LISTEN_HOST = "127.0.0.1";
 async function stableWsToken(remote, workspaceId, root, folder, port) {
   const key = createHash3("sha256").update(`${remote}\x00${workspaceId}\x00${root}\x00${folder}\x00${port}`).digest("hex").slice(0, 32);
   let tokenFile;
   try {
-    tokenFile = path25.join(await getConfigDirPath(), `pipeline-dev-${key}.token`);
-    const existing = fs19.readFileSync(tokenFile, "utf-8").trim();
+    tokenFile = path26.join(await getConfigDirPath(), `pipeline-dev-${key}.token`);
+    const existing = fs20.readFileSync(tokenFile, "utf-8").trim();
     if (existing)
       return existing;
   } catch {}
   const token = randomBytes2(24).toString("base64url");
   if (tokenFile) {
     try {
-      fs19.writeFileSync(tokenFile, token, { mode: 384 });
+      fs20.writeFileSync(tokenFile, token, { mode: 384 });
     } catch {}
   }
   return token;
@@ -100022,7 +100152,7 @@ async function stableWsToken(remote, workspaceId, root, folder, port) {
 function resolveFolder(root, folderArg) {
   if (folderArg)
     return folderArg.replace(/^f\//, "").replace(/\/$/, "");
-  const rel = path25.relative(root, process26.cwd()).replaceAll("\\", "/");
+  const rel = path26.relative(root, process27.cwd()).replaceAll("\\", "/");
   if (rel === "" || rel.startsWith(".."))
     return;
   const segs = rel.split("/");
@@ -100035,12 +100165,12 @@ async function dev3(opts, folderArg) {
   const folder = resolveFolder(root, folderArg);
   if (!folder) {
     error(colors.red("Could not determine the pipeline folder. Pass it explicitly " + "(`wmill pipeline dev <folder>`) or run from inside an `f/<folder>` directory."));
-    process26.exit(1);
+    process27.exit(1);
   }
-  const folderDir = path25.join(root, "f", folder);
-  if (!fs19.existsSync(folderDir)) {
+  const folderDir = path26.join(root, "f", folder);
+  if (!fs20.existsSync(folderDir)) {
     error(colors.red(`Folder not found on disk: ${folderDir}`));
-    process26.exit(1);
+    process27.exit(1);
   }
   const workspace = await resolveWorkspace(opts);
   await requireLogin(opts);
@@ -100083,7 +100213,7 @@ async function dev3(opts, folderArg) {
     }
   }
   let timer;
-  const watcher = fs19.watch(folderDir, { recursive: true });
+  const watcher = fs20.watch(folderDir, { recursive: true });
   watcher.on("change", (_ev, filename) => {
     if (filename && filename.toString().endsWith(".lock"))
       return;
@@ -100138,18 +100268,18 @@ async function dev3(opts, folderArg) {
       open_default(url).catch((e2) => warn(colors.yellow(`Failed to open browser: ${e2.message}`)));
     }
   });
-  process26.on("SIGINT", () => {
+  process27.on("SIGINT", () => {
     info(colors.yellow(`
 \uD83D\uDED1 Shutting down…`));
     watcher.close();
     for (const ws of clients)
       ws.close();
     server.close();
-    process26.exit(0);
+    process27.exit(0);
   });
 }
-var command41 = new Command().description("Live-preview a data pipeline from local files: watch an `f/<folder>` of `// pipeline` scripts, push the working-tree graph to the dev page, and run the cascade via preview (no deploy).").arguments("[folder:string]").option("--port <port:number>", "Port for the dev WebSocket server.").option("--no-open", "Do not open the browser automatically.").option("--frontend <origin:string>", "Origin serving the /pipeline_dev page (e.g. http://localhost:3000 for a locally-run frontend). Defaults to the workspace remote; use it when the remote's deployed frontend predates the dev page.").action(dev3);
-var dev_default3 = command41;
+var command42 = new Command().description("Live-preview a data pipeline from local files: watch an `f/<folder>` of `// pipeline` scripts, push the working-tree graph to the dev page, and run the cascade via preview (no deploy).").arguments("[folder:string]").option("--port <port:number>", "Port for the dev WebSocket server.").option("--no-open", "Do not open the browser automatically.").option("--frontend <origin:string>", "Origin serving the /pipeline_dev page (e.g. http://localhost:3000 for a locally-run frontend). Defaults to the workspace remote; use it when the remote's deployed frontend predates the dev page.").action(dev3);
+var dev_default3 = command42;
 
 // src/commands/pipeline/docs.ts
 init_gen();
@@ -100162,8 +100292,8 @@ await __promiseAll([
   init_conf()
 ]);
 import { writeFile as writeFile25 } from "node:fs/promises";
-import { existsSync as existsSync19, readFileSync as readFileSync8 } from "node:fs";
-import * as path26 from "node:path";
+import { existsSync as existsSync20, readFileSync as readFileSync8 } from "node:fs";
+import * as path27 from "node:path";
 var ASSET_KINDS = "s3object,ducklake,datatable,volume,dbt";
 function assetUri(kind, p3) {
   const prefix = kind === "s3object" ? "s3" : kind;
@@ -100371,8 +100501,8 @@ async function generatePipelineDocs(opts, folder) {
     }
   }
   const md = generatePipelineMarkdown(f3, graph, datatableSchemas, !!opts.local);
-  const folderDir = path26.join(root, "f", f3);
-  await writeFile25(path26.join(folderDir, "PIPELINE.md"), md, "utf-8");
+  const folderDir = path27.join(root, "f", f3);
+  await writeFile25(path27.join(folderDir, "PIPELINE.md"), md, "utf-8");
   const written = ["PIPELINE.md"];
   const pointers = [
     ["AGENTS.md", `See @PIPELINE.md for this pipeline's graph, assets, and how to run it.
@@ -100381,8 +100511,8 @@ async function generatePipelineDocs(opts, folder) {
 `]
   ];
   for (const [name, content] of pointers) {
-    const p3 = path26.join(folderDir, name);
-    if (existsSync19(p3)) {
+    const p3 = path27.join(folderDir, name);
+    if (existsSync20(p3)) {
       let existing;
       try {
         existing = readFileSync8(p3, "utf-8");
@@ -100457,13 +100587,13 @@ function s3Arg(param, obj) {
 }
 
 // src/commands/pipeline/pipeline.ts
-async function apiGet(path27) {
-  const response = await fetch(`${OpenAPI.BASE}${path27}`, {
+async function apiGet(path28) {
+  const response = await fetch(`${OpenAPI.BASE}${path28}`, {
     headers: { Authorization: `Bearer ${OpenAPI.TOKEN}` }
   });
   if (!response.ok) {
     const body = await response.text();
-    throw new Error(`GET ${path27} -> ${response.status}: ${body}`);
+    throw new Error(`GET ${path28} -> ${response.status}: ${body}`);
   }
   return await response.json();
 }
@@ -100482,9 +100612,9 @@ async function list18(opts) {
   }
 }
 var ASSET_KINDS2 = "s3object,ducklake,datatable,volume,dbt";
-function assetUri2(kind, path27) {
+function assetUri2(kind, path28) {
   const prefix = kind === "s3object" ? "s3" : kind;
-  return `${prefix}://${path27}`;
+  return `${prefix}://${path28}`;
 }
 function shortName(scriptPath) {
   return scriptPath.split("/").pop() ?? scriptPath;
@@ -101040,8 +101170,8 @@ Full logs: ${runUrl}`);
     info(colors.green.bold(`Bounded run complete — ${order.length} script(s) succeeded.`));
   }
 }
-var command42 = new Command().description("inspect asset-driven pipelines (scripts marked `// pipeline`, wired by `// on <spec>` annotations)").command("list", "list pipeline folders in the workspace").option("--json", "Output as JSON (for piping to jq)").action(list18).command("show", "render a pipeline folder's DAG (sources, lineage, subscriptions) in the terminal").arguments("<folder:string>").option("--json", "Output the raw asset graph as JSON").option("--local", "Build the graph from local working-tree files (// pipeline scripts) instead of the deployed workspace — no deploy needed.").action(show2).command("run", "run a cascade: from --from (a root OR any mid-DAG model), fan downstream up to the --to end node(s)").arguments("<folder:string>").option("--from <script:string>", "Start script (short name or path). May be any node, including a mid-DAG model — that node plus its transitive downstream runs, upstream is NOT re-run (dbt `--select model+`). Defaults to the folder's sole schedule/manual root.").option("--to <node:string>", "End node(s) to stop at — script names/paths or asset URIs (e.g. datatable://main/staged). Repeatable or comma-separated. Omit to run the full downstream.", { collect: true }).option("--dry-run", "Print the topological run plan without executing.").option("--json", "Output the plan as JSON (for piping to jq).").option("--local", "Run the local working-tree scripts via preview (no deploy) instead of the deployed versions; the graph is built from local files.").option("--upload <binding:string>", "Bind an object to a data_upload/webhook entry point so it runs in the cascade, as SCRIPT[:PARAM]=SOURCE (SOURCE is a local file or an s3://key). Local files are uploaded to the workspace store; the S3Object param is inferred when the script has exactly one. Repeatable.", { collect: true }).option("--arg <binding:string>", "Pass a plain run arg to a script in the cascade, as SCRIPT:PARAM=VALUE (VALUE is parsed as JSON when possible, else taken as a string — e.g. daily_report:partition=2026-07-02). Repeatable.", { collect: true }).option("--partition <value:string>", "Partition value for `// partitioned` scripts in the run (e.g. 2026-06-30) — use it to backfill a past slice. With --local, time kinds (daily/hourly/weekly/monthly) default to the current UTC period when omitted; `dynamic` always needs it. Deployed runs without it defer to backend run-start resolution.").action(run5).command("docs", "generate PIPELINE.md (+ AGENTS.md pointer) describing a folder's pipeline graph and datatable schemas, for an editor / agentic loop").arguments("<folder:string>").option("--local", "Build the graph from local working-tree files instead of the deployed workspace.").action(generatePipelineDocs).command("dev", dev_default3);
-var pipeline_default = command42;
+var command43 = new Command().description("inspect asset-driven pipelines (scripts marked `// pipeline`, wired by `// on <spec>` annotations)").command("list", "list pipeline folders in the workspace").option("--json", "Output as JSON (for piping to jq)").action(list18).command("show", "render a pipeline folder's DAG (sources, lineage, subscriptions) in the terminal").arguments("<folder:string>").option("--json", "Output the raw asset graph as JSON").option("--local", "Build the graph from local working-tree files (// pipeline scripts) instead of the deployed workspace — no deploy needed.").action(show2).command("run", "run a cascade: from --from (a root OR any mid-DAG model), fan downstream up to the --to end node(s)").arguments("<folder:string>").option("--from <script:string>", "Start script (short name or path). May be any node, including a mid-DAG model — that node plus its transitive downstream runs, upstream is NOT re-run (dbt `--select model+`). Defaults to the folder's sole schedule/manual root.").option("--to <node:string>", "End node(s) to stop at — script names/paths or asset URIs (e.g. datatable://main/staged). Repeatable or comma-separated. Omit to run the full downstream.", { collect: true }).option("--dry-run", "Print the topological run plan without executing.").option("--json", "Output the plan as JSON (for piping to jq).").option("--local", "Run the local working-tree scripts via preview (no deploy) instead of the deployed versions; the graph is built from local files.").option("--upload <binding:string>", "Bind an object to a data_upload/webhook entry point so it runs in the cascade, as SCRIPT[:PARAM]=SOURCE (SOURCE is a local file or an s3://key). Local files are uploaded to the workspace store; the S3Object param is inferred when the script has exactly one. Repeatable.", { collect: true }).option("--arg <binding:string>", "Pass a plain run arg to a script in the cascade, as SCRIPT:PARAM=VALUE (VALUE is parsed as JSON when possible, else taken as a string — e.g. daily_report:partition=2026-07-02). Repeatable.", { collect: true }).option("--partition <value:string>", "Partition value for `// partitioned` scripts in the run (e.g. 2026-06-30) — use it to backfill a past slice. With --local, time kinds (daily/hourly/weekly/monthly) default to the current UTC period when omitted; `dynamic` always needs it. Deployed runs without it defer to backend run-start resolution.").action(run5).command("docs", "generate PIPELINE.md (+ AGENTS.md pointer) describing a folder's pipeline graph and datatable schemas, for an editor / agentic loop").arguments("<folder:string>").option("--local", "Build the graph from local working-tree files instead of the deployed workspace.").action(generatePipelineDocs).command("dev", dev_default3);
+var pipeline_default = command43;
 
 // src/commands/ducklake/ducklake.ts
 init_mod3();
@@ -101071,8 +101201,8 @@ async function run6(opts, sql) {
   const name = opts.name ?? DEFAULT_DUCKLAKE_NAME;
   await runCatalogQuery(opts, "ducklake", name, sql);
 }
-var command43 = new Command().description("ducklake related commands").command("list", "list all ducklakes in the workspace").option("--json", "Output as JSON (for piping to jq)").action(list19).command("run", "run a SQL query on a ducklake").arguments("<sql:string>").option("-n --name <name:string>", "Ducklake name (default: main)").option("-s --silent", "Output only the final result as JSON. Useful for scripting.").action(run6);
-var ducklake_default = command43;
+var command44 = new Command().description("ducklake related commands").command("list", "list all ducklakes in the workspace").option("--json", "Output as JSON (for piping to jq)").action(list19).command("run", "run a SQL query on a ducklake").arguments("<sql:string>").option("-n --name <name:string>", "Ducklake name (default: main)").option("-s --silent", "Output only the final result as JSON. Useful for scripting.").action(run6);
+var ducklake_default = command44;
 
 // src/commands/object-storage/object-storage.ts
 init_mod3();
@@ -101273,8 +101403,8 @@ async function preview3(opts, fileKey) {
 `);
   }
 }
-var command44 = new Command().alias("s3").description("Object storage (S3) related commands. Operates on the workspace's default object storage; use --storage to target a configured secondary storage.").action(listStorages).command("list", "List configured object storages for the workspace (default + secondary).").option("--json", "Output as JSON (for piping to jq)").action(listStorages).command("files", "List files in an object storage. Optionally filter by prefix.").alias("ls").arguments("[prefix:string]").option("--json", "Output as JSON (for piping to jq)").option("--max-keys <maxKeys:number>", "Page size (default 100)").option("--marker <marker:string>", "Pagination marker from a previous response").option("--storage <storage:string>", "Secondary storage name (omit for the workspace default)").action(listFiles).command("upload", "Upload a local file to object storage at the given file key.").arguments("<local_path:string> <file_key:string>").option("--storage <storage:string>", "Secondary storage name").option("--content-type <contentType:string>", "Content-Type header to set on the object").option("--content-disposition <contentDisposition:string>", "Content-Disposition header to set on the object").action(upload).command("download", "Download an object to a local file (or stdout). Default output path is the basename of the file key in the current directory.").arguments("<file_key:string> [output_path:string]").option("--storage <storage:string>", "Secondary storage name").option("--stdout", "Write file contents to stdout instead of a file").action(download).command("delete", "Delete an object from object storage. Prompts for confirmation unless --yes is set.").arguments("<file_key:string>").option("--storage <storage:string>", "Secondary storage name").option("--yes", "Skip the confirmation prompt").action(del).command("move", "Move an object within the same storage (rename or relocate by key).").arguments("<src_file_key:string> <dest_file_key:string>").option("--storage <storage:string>", "Secondary storage name").action(move).command("info", "Show metadata (size, mime, last-modified) for an object.").arguments("<file_key:string>").option("--json", "Output as JSON (for piping to jq)").option("--storage <storage:string>", "Secondary storage name").action(info2).command("preview", "Preview the contents of an object (text/CSV). Use --bytes-from / --bytes-length to peek at a slice of binary files.").arguments("<file_key:string>").option("--storage <storage:string>", "Secondary storage name").option("--mime <mime:string>", "Override the detected mime type (e.g. text/csv)").option("--bytes-from <bytesFrom:number>", "Start offset in bytes").option("--bytes-length <bytesLength:number>", "Number of bytes to read").option("--csv-separator <csvSeparator:string>", "CSV column separator (default ,)").option("--csv-header", "Treat the first CSV row as a header").action(preview3);
-var object_storage_default = command44;
+var command45 = new Command().alias("s3").description("Object storage (S3) related commands. Operates on the workspace's default object storage; use --storage to target a configured secondary storage.").action(listStorages).command("list", "List configured object storages for the workspace (default + secondary).").option("--json", "Output as JSON (for piping to jq)").action(listStorages).command("files", "List files in an object storage. Optionally filter by prefix.").alias("ls").arguments("[prefix:string]").option("--json", "Output as JSON (for piping to jq)").option("--max-keys <maxKeys:number>", "Page size (default 100)").option("--marker <marker:string>", "Pagination marker from a previous response").option("--storage <storage:string>", "Secondary storage name (omit for the workspace default)").action(listFiles).command("upload", "Upload a local file to object storage at the given file key.").arguments("<local_path:string> <file_key:string>").option("--storage <storage:string>", "Secondary storage name").option("--content-type <contentType:string>", "Content-Type header to set on the object").option("--content-disposition <contentDisposition:string>", "Content-Disposition header to set on the object").action(upload).command("download", "Download an object to a local file (or stdout). Default output path is the basename of the file key in the current directory.").arguments("<file_key:string> [output_path:string]").option("--storage <storage:string>", "Secondary storage name").option("--stdout", "Write file contents to stdout instead of a file").action(download).command("delete", "Delete an object from object storage. Prompts for confirmation unless --yes is set.").arguments("<file_key:string>").option("--storage <storage:string>", "Secondary storage name").option("--yes", "Skip the confirmation prompt").action(del).command("move", "Move an object within the same storage (rename or relocate by key).").arguments("<src_file_key:string> <dest_file_key:string>").option("--storage <storage:string>", "Secondary storage name").action(move).command("info", "Show metadata (size, mime, last-modified) for an object.").arguments("<file_key:string>").option("--json", "Output as JSON (for piping to jq)").option("--storage <storage:string>", "Secondary storage name").action(info2).command("preview", "Preview the contents of an object (text/CSV). Use --bytes-from / --bytes-length to peek at a slice of binary files.").arguments("<file_key:string>").option("--storage <storage:string>", "Secondary storage name").option("--mime <mime:string>", "Override the detected mime type (e.g. text/csv)").option("--bytes-from <bytesFrom:number>", "Start offset in bytes").option("--bytes-length <bytesLength:number>", "Number of bytes to read").option("--csv-separator <csvSeparator:string>", "CSV column separator (default ,)").option("--csv-header", "Treat the first CSV row as a header").action(preview3);
+var object_storage_default = command45;
 
 // src/main.ts
 await init_context();
@@ -101294,7 +101424,7 @@ async function checkVersionSafe(cmd) {
   }
   mainCommand.version(`${currentVersion}  (New version available: ${latestVersion}. Run '${mainCommand.getName()} upgrade' to upgrade to the latest version!)`);
 }
-var command45 = new Command().name("wmill").action(() => info(`Welcome to Windmill CLI ${VERSION}. Use -h for help.`)).description("Windmill CLI").globalOption("--workspace <workspace:string>", "Specify the target workspace. This overrides the default workspace.").globalOption("--debug --verbose", "Show debug/verbose logs").globalOption("--show-diffs", "Show diff informations when syncing (may show sensitive informations)").globalOption("--token <token:string>", "Specify an API token. This will override any stored token.").globalOption("--base-url <baseUrl:string>", "Specify the base URL of the API. If used, --token and --workspace are required and no local remote/workspace already set will be used.").globalOption("--config-dir <configDir:string>", "Specify a custom config directory. Overrides WMILL_CONFIG_DIR environment variable and default ~/.config location.").env("HEADERS <headers:string>", `Specify headers to use for all requests. e.g: "HEADERS='h1: v1, h2: v2'"`).version(VERSION).versionOption(false).helpOption("-h, --help", "Show this help.", {
+var command46 = new Command().name("wmill").action(() => info(`Welcome to Windmill CLI ${VERSION}. Use -h for help.`)).description("Windmill CLI").globalOption("--workspace <workspace:string>", "Specify the target workspace. This overrides the default workspace.").globalOption("--debug --verbose", "Show debug/verbose logs").globalOption("--show-diffs", "Show diff informations when syncing (may show sensitive informations)").globalOption("--token <token:string>", "Specify an API token. This will override any stored token.").globalOption("--base-url <baseUrl:string>", "Specify the base URL of the API. If used, --token and --workspace are required and no local remote/workspace already set will be used.").globalOption("--config-dir <configDir:string>", "Specify a custom config directory. Overrides WMILL_CONFIG_DIR environment variable and default ~/.config location.").env("HEADERS <headers:string>", `Specify headers to use for all requests. e.g: "HEADERS='h1: v1, h2: v2'"`).version(VERSION).versionOption(false).helpOption("-h, --help", "Show this help.", {
   action: async function() {
     const self2 = this;
     const long = self2.getRawArgs().includes(`--${self2.getHelpOption()?.name}`);
@@ -101336,20 +101466,20 @@ var command45 = new Command().name("wmill").action(() => info(`Welcome to Windmi
   error(e2);
   info("Try running with sudo and otherwise check the result of the command: npm uninstall windmill-cli && npm install -g windmill-cli");
 })).command("completions", new Command().description("Generate shell completions.").command("bash", new Command().description("Generate bash completions.").action(() => {
-  process.stdout.write(generateShellCompletions(command45, "bash") + `
+  process.stdout.write(generateShellCompletions(command46, "bash") + `
 `);
 })).command("zsh", new Command().description("Generate zsh completions.").action(() => {
-  process.stdout.write(generateShellCompletions(command45, "zsh") + `
+  process.stdout.write(generateShellCompletions(command46, "zsh") + `
 `);
 })).command("fish", new Command().description("Generate fish completions.").action(() => {
-  process.stdout.write(generateShellCompletions(command45, "fish") + `
+  process.stdout.write(generateShellCompletions(command46, "fish") + `
 `);
 })));
 async function main2() {
   try {
     const args = process.argv.slice(2);
     if (args.length === 0) {
-      command45.showHelp();
+      command46.showHelp();
     }
     const LOG_LEVEL = args.includes("--verbose") || args.includes("--debug") ? "DEBUG" : "INFO";
     setShowDiffs(args.includes("--show-diffs"));
@@ -101369,7 +101499,7 @@ async function main2() {
       const { warnIfTsconfigStale: warnIfTsconfigStale2 } = await init_tsconfig().then(() => exports_tsconfig);
       await warnIfTsconfigStale2().catch(() => {});
     }
-    await command45.parse(args);
+    await command46.parse(args);
   } catch (e2) {
     if (e2 && typeof e2 === "object" && "name" in e2 && e2.name === "ApiError") {
       const body = e2.body;
@@ -101405,7 +101535,7 @@ if (isMain()) {
     process.stdin.destroy();
   });
 }
-var main_default = command45;
+var main_default = command46;
 export {
   add as workspaceAdd,
   workspace_default as workspace,